**5 issues found** across 9 files

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P2: The 404 response body is not consumed before `continue`, which can leak connections in Cloudflare Workers. Cancel or drain the body before moving to the `.ts` suffix retry. P2: The proxy `get` trap doesn't filter out `Symbol` properties. Runtime symbol accesses (e.g., `Symbol.toPrimitive` during coercion, or `Symbol.toStringTag` during logging) will create broken proxy chains with symbols in the path array. P1: Re-running `setupApps()` on every `onChange` duplicates app middleware registrations and can make middleware run multiple times per request. P2: Dependency flattening visits deps before parents, combined with first-wins registration semantics in `registerInvokeHandlers`. This means parent apps cannot override handlers from their own dependencies. If this is intentional, a comment explaining the rationale would help; otherwise, reverse the iteration order or the registration priority. P1: Apps without middleware never have their state injected into `RequestContext`. `getAppState(appName)` silently returns `undefined` for any app that doesn't define a `middleware` property, because state registration is gated behind `if (app.middleware)`. Separate state tracking from middleware tracking so all apps' states are available per-request. ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review.}