~x-ai/grok-latest → B (2:3)

B fixes foundational CanonicalItemUrl identity (legacy `…/~/` vs `…/~` root keys, normalized_storage, tilde_http_path_to_canonical) so garden child rankings and room/public root pages resolve correctly, backed by unit, integration, and browser tests. A is a real, precise XSS harden (ammonia at PreEscaped render sites plus targeted sanitize tests) but is localized to Reddit HTML embedding, whereas B corrects core path/storage design the app relies on everywhere.