1. [spec] [apps/go/web/web.go:268](/home/paulca/amadan.net/carlos/todomvc-bakeoff/.worktrees/go/apps/go/web/web.go:268): Any cookie decoding to 32 bytes is accepted, even if the server never issued it. For example, 43 `A` characters becomes a persistent, predictable list identity instead of receiving a fresh random cookie. Visitors supplying that same unissued value share a list. Track issued identities and replace unknown cookies.

2. [correctness] [apps/go/web/static/app.js:41](/home/paulca/amadan.net/carlos/todomvc-bakeoff/.worktrees/go/apps/go/web/static/app.js:41): Every response removes the entire list, including any edit started while that request was pending. Toggle one item, then edit another before the toggle response arrives: the response replaces the edit field and discards the draft. Preserve active edits across fragment replacements or defer replacement until the edit finishes.