Merge TASK-067: remove v1 registered_resources* maps and namespace compat shim

Author: etr

RELEASE_NOTES.md

@@ -65,6 +65,32 @@ v1.x is end-of-life on the day v2.0 ships.
   must include them directly.
 - **The implicit conversion** `webserver ws = cw;` (where `cw` is a
   `create_webserver`). The constructor is now `explicit`.
+- **v1 compat auth-handler shim.** `httpserver::compat::auth_handler_v1_ptr`,
+  `httpserver::compat::adapt_legacy_auth`, and the
+  `[[deprecated]] create_webserver::auth_handler(compat::auth_handler_v1_ptr)`
+  overload are removed (TASK-067). The transitional shim that let v1
+  callers spell their auth handler as
+  `std::function<std::shared_ptr<http_response>(const http_request&)>`
+  was scheduled for removal "in the next release"; this is that removal.
+  Migrate to the canonical `auth_handler_ptr` returning
+  `std::optional<http_response>` (`std::nullopt` to allow, engaged value
+  to reject). The `namespace httpserver::compat` is dissolved with no
+  surviving members. **Source incompatibility:** TUs that called
+  `auth_handler(<legacy shape>)` fail to compile against v2.1 headers;
+  the legacy callable is no longer implicitly convertible to
+  `auth_handler_ptr`. There is no runtime ABI surface to break — the
+  overload was a header-only inline forwarder.
+- **v1 `registered_resources*` registration maps (internal).** No
+  public-API change. Dispatch already routed through the v2 3-tier
+  route table (`lookup_v2()`) after TASK-053; the residual
+  registration-time maps (`registered_resources`,
+  `registered_resources_str`, `registered_resources_regex`) and their
+  shared mutex are now deleted (TASK-067). Lambda/class path-conflict
+  detection consults the v2 route table directly via
+  `find_v2_entry_by_path_`; duplicate-registration detection moved
+  inside `register_v2_route`; the WebSocket handler registry gains a
+  dedicated `registered_ws_handlers_mutex_`. Callers observe no
+  behavioural change.
 
 ## What's new
 
@@ -178,11 +204,7 @@ and see the v2 replacement.
   (earlier v2 work-in-progress shipped
   `std::function<std::shared_ptr<http_response>(const http_request&)>`).
   Return `std::nullopt` to allow the request; return an `http_response`
-  to reject. The v1 `shared_ptr` shape still compiles via
-  `httpserver::compat::auth_handler_v1_ptr` and a `[[deprecated]]`
-  setter overload (both emit a deprecation warning); the compat alias
-  and overload are scheduled for removal in v2.1.
-  Removes one heap allocation per authenticated request.
+  to reject. Removes one heap allocation per authenticated request.
 - **`http_request` getters return `const&` / `string_view`.** v1's
   `get_header(name)` (and `get_arg`, `get_cookie`, `get_footer`) returned
   by value and inserted an empty entry into the request map on miss; v2's

specs/architecture/04-components/route-table.md

@@ -27,6 +27,6 @@ A `route_entry` carries:
 
 **Related requirements:** PRD-HDL-REQ-002, PRD-HDL-REQ-004, PRD-HDL-REQ-006.
 
-**Implementation status:** TASK-025 introduced `detail::route_entry` and the `lambda_resource` shim into the existing v1 three-map storage shape. TASK-027 wired `route_entry` into the full 3-tier table described above (hash map for exact paths, radix tree for parameterized/prefix paths, regex chain for regex routes). TASK-053 retired the v1 dispatch path: `webserver_impl::resolve_resource_for_request` now consults `lookup_v2()` (cache → exact → radix → regex) directly, the v1 LRU cache and the four v1 lookup helpers (`lookup_route_cache`, `scan_regex_routes`, `store_route_cache`, `apply_extracted_params`) are deleted, and the LRU cache field is renamed `route_lru_cache`. The v1 registration-side maps (`registered_resources`, `registered_resources_str`, `registered_resources_regex`) survive *only* as registration-time bookkeeping for `prepare_or_create_lambda_shim` (lambda/class conflict detection) and the WebSocket dispatch path, both of which are non-HTTP-dispatch concerns; their removal is its own follow-up task. TASK-056 swapped the radix-node child container from `std::unordered_map` to `std::map<…, std::less<>>` for CWE-407 immunity and added registration-time detection of prefix-vs-exact terminus collisions (`reject_terminus_collision`).
+**Implementation status:** TASK-025 introduced `detail::route_entry` and the `lambda_resource` shim into the existing v1 three-map storage shape. TASK-027 wired `route_entry` into the full 3-tier table described above (hash map for exact paths, radix tree for parameterized/prefix paths, regex chain for regex routes). TASK-053 retired the v1 dispatch path: `webserver_impl::resolve_resource_for_request` now consults `lookup_v2()` (cache → exact → radix → regex) directly, the v1 LRU cache and the four v1 lookup helpers (`lookup_route_cache`, `scan_regex_routes`, `store_route_cache`, `apply_extracted_params`) are deleted, and the LRU cache field is renamed `route_lru_cache`. **TASK-067** deleted the v1 registration-side maps (`registered_resources`, `registered_resources_str`, `registered_resources_regex`) and their shared mutex; the v2 3-tier table is now the only routing surface end-to-end. Lambda/class path-conflict detection (`prepare_or_create_lambda_shim`) probes the v2 tiers via `find_v2_entry_by_path_`; the WebSocket registration map keeps its own `registered_ws_handlers_mutex_`. TASK-056 swapped the radix-node child container from `std::unordered_map` to `std::map<…, std::less<>>` for CWE-407 immunity and added registration-time detection of prefix-vs-exact terminus collisions (`reject_terminus_collision`).
 
 ---

specs/tasks/M7-v2-cleanup/TASK-067.md

@@ -34,4 +34,4 @@ Cut them in a single, well-tested PR so the v2 dispatch path is the only one.
 **Related Requirements:** PRD §2 API minimalism, PRD §1 release strategy
 **Related Decisions:** DR-007, DR-011
 
-**Status:** Backlog
+**Status:** Done

specs/tasks/M7-v2-cleanup/_index.md

@@ -31,7 +31,7 @@ TASK-093).
 | TASK-064 | Structured cookie type | HIGH | M | Backlog |
 | TASK-065 | RFC 5952 IPv6 zero-compression in `peer_address` | HIGH | S | Done |
 | TASK-066 | Runtime setter for hook alias slots | MED | M | Backlog |
-| TASK-067 | Remove v1 `registered_resources*` maps and `namespace compat` shim | MED | L | Backlog |
+| TASK-067 | Remove v1 `registered_resources*` maps and `namespace compat` shim | MED | L | Done |
 | TASK-068 | `connection_state` hardening — CWE-226 / CWE-14 | MED | S | Backlog |
 | TASK-069 | Remove transitional two-arg `http_request_impl` constructor | MED | S | Backlog |
 | TASK-070 | Migrate `hook_table_` to `std::atomic<std::shared_ptr<T>>` | MED | M | Backlog |