[spec] apps/go/web/web.go:268: Any cookie decoding to 32 bytes is accepted, even if the server never issued it. For example, 43 A characters becomes a persistent, predictable list identity instead of receiving a fresh random cookie. Visitors supplying that same unissued value share a list. Track issued identities and replace unknown cookies.
[correctness] apps/go/web/static/app.js:41: Every response removes the entire list, including any edit started while that request was pending. Toggle one item, then edit another before the toggle response arrives: the response replaces the edit field and discards the draft. Preserve active edits across fragment replacements or defer replacement until the edit finishes.
amadan