1. [security] `apps/ocaml/bin/main.ml:86` — The HTTP server uses Cohttp-eio’s unbounded request buffer (`max_size:max_int`), with no header-size limit. A single request containing an enormous header line can exhaust process memory before the callback’s 1 MiB body limit applies, denying service to every visitor. Bound request-line and header parsing.

2. [correctness] `apps/ocaml/static/app.js:34` — Every response removes the entire list, including any active editor. With a delayed toggle/add response, double-click another todo and start typing before that response arrives: the editor disappears and the unsaved text is lost. Preserve active edits across response rendering.

3. [correctness] `apps/ocaml/src/app.ml:120` — `String.trim` does not remove Unicode whitespace such as U+00A0; the edit path at line 128 has the same problem. Submitting only non-breaking spaces creates a visually empty todo, and editing to that value does not delete it. Apply Unicode-aware trimming consistently to additions and edits.

4. [spec] `apps/ocaml/Makefile:33` — `clean-deps` removes the opam switches but leaves precompiled native dependencies; the arm64 build continues linking the emulated root’s prebuilt SQLite library. Consequently, the next build does not compile every third-party library from source as the brief requires. Build SQLite in the app’s cache and remove its compiled artifacts in `clean-deps`, retaining its downloaded source.