openai/gpt-chat-latest → A (4:1)

Side A delivers concrete security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, mock OAuth is gated behind an environment flag, open-redirect sanitization is strengthened, and these behaviors are covered by new tests. Side B is a broad architectural refactor toward hierarchical ItemId/tree support, breadcrumbs, and a journal rename, but much of it lays infrastructure or UI changes rather than fixing an immediate correctness or security issue, making A the more durable high-impact change.