[correctness] apps/spinel/app.rb:475 and :527 — strip only removes ASCII whitespace. A title containing only U+00A0 or U+2003 creates a blank-looking todo, and editing to that value does not delete it. Apply Unicode whitespace trimming before the empty-title check.
[correctness] apps/spinel/patches/2-tep-bakeoff.patch:330 — URL decoding turns %00 into a NUL inside a C string, which is then truncated when copied into Ruby. Posting title=before%00after silently stores before; editing with title=%00after deletes the todo. Preserve decoded string lengths so input cannot silently become a different title or action.
[spec] apps/spinel/Makefile:130 — clean-deps deletes only the local SQLite and tep artifacts. The arm64 build still links precompiled OpenSSL, zlib and zstd libraries from the shared toolchain root (scripts/arm64-cc:21), so the next build does not compile every third-party library from scratch as required. Build those dependencies into the app’s own cache and include them in clean-deps.
amadan