~x-ai/grok-latest → B (2:1)

B closes a lasting XSS hole by sanitizing untrusted Reddit body HTML with ammonia at render time (focused sanitize module + unit tests) instead of raw PreEscaped. A is a real functional fix (apply_entity_under_parent, title-based unranked labels, stronger import tests) but is feature/correctness work, not foundational safety like B.