~x-ai/grok-latest → B (3:2)

B fixes production-critical Reddit fetching by requiring OAuth when credentials exist (no public www fallback that cloud IPs block), with token refresh on 401/403 and clearer auth error handling—core durability for the app’s data path. A is a real, lasting XSS hardening via ammonia at render time with tests, but it is a narrower defense on already-fetched HTML versus B’s broader reliability/design change to the fetch/auth pipeline.