You are reviewing one entry in the CARLOS TodoMVC bakeoff: the
**{LANGUAGE}** app in `apps/{SLUG}/`. It was built by another agent from
`BRIEF.md` and `CONTRACT.md` (read both), against the TodoMVC app spec
(https://github.com/tastejs/todomvc/blob/master/app-spec.md) as the
contract adapts it.

Review for **correctness, spec compliance and security only**. Don't
suggest performance tuning, style changes or refactors. Every app gets
exactly one fix round, so list only what a reasonable person would need
fixed: behaviour that's wrong, a contract or brief requirement that's
missed, or a security problem (injection, cross-site, cross-list access,
cookie handling, unsafe SQL, resource exhaustion from a single request,
anything that leaks or corrupts another visitor's data).

Check the platform contract too: `--socket`/`--db`/`--listen`,
`/healthz`, `/api/version`, `CARLOS_HOST`, static or libc-only linkage,
WAL, additive migrations, SIGTERM, and the Makefile targets including
`clean-deps`, `bump` and `unbump`.

Write a numbered list. Start each item with exactly one tag:
`[security]`, `[correctness]` or `[spec]`, then the file and line, what's
wrong, and how it shows up. If nothing needs fixing, write exactly
`No findings.` Write nothing else.