~anthropic/claude-sonnet-latest → B (6:4)

B is a small, focused security fix that closes an actual XSS hole (untrusted Reddit selftext_html rendered raw via PreEscaped) with a tested sanitizer applied at both render sites. A is a large ItemId refactor that improves internal typing but introduces lossy fallbacks (ItemId::opaque on parse failure) and a deleted plan.md, providing real but riskier and less immediately critical value than fixing a live script-injection vulnerability.