~anthropic/claude-sonnet-latest → A (6:4)

A fixes a real security vulnerability (unsanitized Reddit HTML enabling XSS) with a focused, well-tested sanitize module, which is high-value and low-risk. B is a larger architectural refactor (async settlement worker, cached ranking, dead demo-counter removal) that's plausible but riskier, untested for the new worker's concurrency correctness, and its commit message ('nice') signals less deliberate documentation of intent despite the code volume.