**11 issues found** across 24 files

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P2: `assertNotNull(ex.getMessage())` is too weak here and can pass for unrelated connection failures, so the test no longer verifies API-key auth rejection specifically. P3: Javadoc opcode value is wrong: `ACK` is `0x16`, not `0x15` (0x15 is `CANCEL_CONSUME`). P3: Javadoc opcode value is wrong: `NACK` is `0x18`, not `0x17` (0x17 is `ACK_RESULT`). P2: Restore the interrupt flag when handling `InterruptedException` instead of swallowing it in a combined catch block. P1: `writeString` can silently overflow its U16 length prefix, producing invalid frames for long strings. P1: `writeStringMap` can overflow the U16 element count and corrupt decoding for large maps. P1: `readBytes` should validate decoded length before allocating to avoid malformed-frame crashes or excessive allocation. P1: Socket and stream resources leak if `performHandshake()` throws. Wrap the handshake (and read-loop start) in a try-catch that closes the socket on failure. P2: `readFrame()` returns `null` for continuation frames, but `performHandshake()` dereferences the result without a null check, risking an NPE. Loop until a non-null frame is received. P2: `InterruptedException` caught without restoring the interrupt flag. All `catch (IOException | InterruptedException e)` blocks in this class wrap the exception but never call `Thread.currentThread().interrupt()`, unlike the batched `enqueue()` path which handles it correctly. This drops the interrupt signal, breaking cooperative cancellation for callers. P1: Connection and client leak in leader redirect. `leaderConn` is never closed — `AutoCloseable.close()` is not called by GC, and the `ConsumerHandle` returned by `leaderClient.consume()` is discarded, so the redirected consumer can never be cancelled or its connection released. ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review.}