[correctness] apps/rust/static/app.js:10: Filter navigation can discard pending changes. Requests wait in a promise queue, but filter links navigate immediately. With a toggle request pending, edit another todo and click a filter: blur queues the save, then navigation destroys the queue before that save reaches the server. Wait for pending actions before navigating.
[spec] apps/rust/src/main.rs:45: --listen accepts every loopback address, including ::1 and 127.0.0.2. The brief explicitly restricts binding to 127.0.0.1. Validate that exact address.