carlos / todomvc-bakeoff Public

You are reviewing one entry in the CARLOS TodoMVC bakeoff: the {LANGUAGE} app in apps/{SLUG}/. It was built by another agent from BRIEF.md and CONTRACT.md (read both), against the TodoMVC app spec (https://github.com/tastejs/todomvc/blob/master/app-spec.md) as the contract adapts it.

Review for correctness, spec compliance and security only. Don't suggest performance tuning, style changes or refactors. Every app gets exactly one fix round, so list only what a reasonable person would need fixed: behaviour that's wrong, a contract or brief requirement that's missed, or a security problem (injection, cross-site, cross-list access, cookie handling, unsafe SQL, resource exhaustion from a single request, anything that leaks or corrupts another visitor's data).

Check the platform contract too: --socket/--db/--listen, /healthz, /api/version, CARLOS_HOST, static or libc-only linkage, WAL, additive migrations, SIGTERM, and the Makefile targets including clean-deps, bump and unbump.

Write a numbered list. Start each item with exactly one tag: [security], [correctness] or [spec], then the file and line, what's wrong, and how it shows up. If nothing needs fixing, write exactly No findings. Write nothing else.