~x-ai/grok-latest → A (3:2)

A hardens production auth (fail-closed vote actors instead of silent anon fallback, mock OAuth gated by env, Secure cookies, tighter return_to sanitization) and adds durable session UX/tests, which is lasting security and correctness. B’s settlement worker and ranking cache are solid core design and demo-counter removal is good cleanup, but they improve an earlier scaffold path rather than matching A’s multi-point security/ownership guarantees.