**10 issues found** across 24 files

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P3: Close the temporary client in this rejection test; it currently leaks a connection when the expected exception is raised. P3: Close this temporary TLS client in an `ensure` block to avoid leaking connections during test execution. P2: Ensure the client is closed even when `create_queue` raises; otherwise failed admin calls can leak open connections. P1: Close the probe client in an `ensure` block so retry failures do not leak sockets during server startup. P0: **TLS peer verification disabled when custom CA cert is provided.** `ctx.verify_mode` is never set in the `@ca_cert` branch, so it defaults to `VERIFY_NONE`. The custom CA cert store is populated but never actually used for verification — any server certificate will be accepted, defeating the purpose of TLS and enabling MITM attacks. Add `verify_mode` and `verify_hostname` after setting the cert store. P2: String concatenation with `+=` in a loop is O(n²) — each iteration copies the entire accumulated buffer. Use `<<` to append in-place. P1: `decode_stats_result` is called but never defined — `get_stats` will raise `NoMethodError` at runtime. The method implementation needs to be added to the `private` section of the `Client` class. P1: `decode_list_queues_result` is called but never defined — `list_queues` will raise `NoMethodError` at runtime. The method implementation needs to be added to the `private` section of the `Client` class. P2: After a leader redirect, the `ensure` block cancels `rid` on the **new** connection instead of the old one. Cancel the subscription and nil out `rid` before reconnecting, so the ensure block doesn't send a stale cancel to the wrong server. P2: `reconnect_to` replaces `@conn` but the `Batcher` still holds a reference to the old (closed) connection. After a leader redirect during consume, subsequent enqueue calls through the batcher will fail. Consider giving the Batcher a way to update its connection reference, or having it access the client's connection indirectly. ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review.}