[security] apps/ocaml/bin/main.ml:86 — The HTTP server uses Cohttp-eio’s unbounded request buffer (max_size:max_int), with no header-size limit. A single request containing an enormous header line can exhaust process memory before the callback’s 1 MiB body limit applies, denying service to every visitor. Bound request-line and header parsing.
[correctness] apps/ocaml/static/app.js:34 — Every response removes the entire list, including any active editor. With a delayed toggle/add response, double-click another todo and start typing before that response arrives: the editor disappears and the unsaved text is lost. Preserve active edits across response rendering.
[correctness] apps/ocaml/src/app.ml:120 — String.trim does not remove Unicode whitespace such as U+00A0; the edit path at line 128 has the same problem. Submitting only non-breaking spaces creates a visually empty todo, and editing to that value does not delete it. Apply Unicode-aware trimming consistently to additions and edits.
[spec] apps/ocaml/Makefile:33 — clean-deps removes the opam switches but leaves precompiled native dependencies; the arm64 build continues linking the emulated root’s prebuilt SQLite library. Consequently, the next build does not compile every third-party library from source as the brief requires. Build SQLite in the app’s cache and remove its compiled artifacts in clean-deps, retaining its downloaded source.
amadan