~x-ai/grok-latest → A (4:1)

Commit A ships lasting product surface: session cookies and web login/logout, private room pages/threads with ACL checks, compose/post forms via rpc_post_with_bearer, and ThreadNav so public and room UIs share one path model. Commit B is a worthwhile type-safety refactor (CanonicalItemUrl through resolve_item/rank/pair paths and Deref on href newtypes) that removes String churn but does not add user-facing capability.