~x-ai/grok-latest → A (2:1)

A closes a real XSS hole by sanitizing untrusted Reddit HTML with ammonia at render time (shared helper, two call sites, unit tests), which is lasting security value. B is a precise, correct reducer bugfix (move zero-ratio return before ensure_item/voted_pairs) that prevents ghost state, but its scope and impact are narrower than preventing script execution in-origin.