TASK-067: remove v1 registered_resources* maps and namespace compat shim

Three transitional v1 surfaces are gone, leaving the v2 3-tier route
table as the only registration / dispatch oracle:

  1. webserver_impl::{registered_resources, registered_resources_str,
     registered_resources_regex, registered_resources_mutex} — registration-
     time bookkeeping replaced by direct writes to exact_routes_, the radix
     tree (param_and_prefix_routes_), and regex_routes_. Duplicate detection
     migrates from the v1 ordered map's .insert() oracle to a new
     reject_duplicate_v2_entry_ helper that probes the correct v2 tier for
     a pre-existing entry before any mutation — preserving the
     "throw-leaves-table-prior-state" atomicity contract pinned by
     basic_suite::duplicate_endpoints.

  2. namespace httpserver::compat (auth_handler_v1_ptr +
     adapt_legacy_auth), the [[deprecated]] create_webserver::auth_handler
     overload accepting it, and the paired push/pop
     -Wdeprecated-declarations suppression at the forwarding call site —
     all removed. The auth_handler_legacy_shim_test TU goes away; a new
     no_v1_compat_shim_test TU pins the post-removal sentinel via a
     std::void_t SFINAE detection idiom (negative compile-time check that
     the v1 shared_ptr-returning shape is no longer accepted).

  3. Readers of the v1 maps — prepare_or_create_lambda_shim's conflict
     detection, the resolve_single_resource_ short-circuit in dispatch,
     and the WebSocket-path's use of registered_resources_mutex to guard
     registered_ws_handlers — all rewired. WebSocket registration/dispatch
     now uses a dedicated ws_handlers_mutex_ instead of piggy-backing on
     the deleted v1 mutex. The single_resource fast path is folded into
     lookup_v2 (a single registered prefix terminus at "/" surfaces as a
     trivial radix descent).

TASK-070 (the partner -Wdeprecated-declarations suppression in
http_resource.cpp:81-115 that the action-items list points to) is
explicitly handed off — its own M-sized scope (atomic shared_ptr
migration) would balloon this PR.

Drive-by fixes surfaced by the fresh integ-test rebuild this commit
forces:
  - test/integ/basic.cpp:155,367 — wrap two legacy
    with_cookie(string,string) call sites in -Wdeprecated-declarations
    push/pop. Pre-existing TASK-064 deprecation that incremental builds
    silently skipped (basic.o was stale from before TASK-064).
  - test/integ/basic.cpp:498 — duplicate_endpoints's "ok" vs "OK"
    case-folding assertion was pinning a v1 quirk (registered_resources
    used http_endpoint::operator<, unconditionally case-insensitive via
    std::toupper regardless of CASE_INSENSITIVE). The v2 route table is
    consistently case-sensitive without -DCASE_INSENSITIVE, so the
    assertion is now CASE_INSENSITIVE-gated to match dispatch-time
    lookup semantics.

Acceptance criteria (all satisfied):
  - grep -nE 'registered_resources' src/httpserver/detail/webserver_impl.hpp
    returns no matches.
  - grep -nE 'namespace compat' src/httpserver/create_webserver.hpp returns
    no matches.
  - grep -nE 'Wdeprecated-declarations' src/httpserver/create_webserver.hpp
    returns no matches.
  - make -j1 check passes 95/95 tests.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: etr

RELEASE_NOTES.md

@@ -65,6 +65,32 @@ v1.x is end-of-life on the day v2.0 ships.
   must include them directly.
 - **The implicit conversion** `webserver ws = cw;` (where `cw` is a
   `create_webserver`). The constructor is now `explicit`.
+- **v1 compat auth-handler shim.** `httpserver::compat::auth_handler_v1_ptr`,
+  `httpserver::compat::adapt_legacy_auth`, and the
+  `[[deprecated]] create_webserver::auth_handler(compat::auth_handler_v1_ptr)`
+  overload are removed (TASK-067). The transitional shim that let v1
+  callers spell their auth handler as
+  `std::function<std::shared_ptr<http_response>(const http_request&)>`
+  was scheduled for removal "in the next release"; this is that removal.
+  Migrate to the canonical `auth_handler_ptr` returning
+  `std::optional<http_response>` (`std::nullopt` to allow, engaged value
+  to reject). The `namespace httpserver::compat` is dissolved with no
+  surviving members. **Source incompatibility:** TUs that called
+  `auth_handler(<legacy shape>)` fail to compile against v2.1 headers;
+  the legacy callable is no longer implicitly convertible to
+  `auth_handler_ptr`. There is no runtime ABI surface to break — the
+  overload was a header-only inline forwarder.
+- **v1 `registered_resources*` registration maps (internal).** No
+  public-API change. Dispatch already routed through the v2 3-tier
+  route table (`lookup_v2()`) after TASK-053; the residual
+  registration-time maps (`registered_resources`,
+  `registered_resources_str`, `registered_resources_regex`) and their
+  shared mutex are now deleted (TASK-067). Lambda/class path-conflict
+  detection consults the v2 route table directly via
+  `find_v2_entry_by_path_`; duplicate-registration detection moved
+  inside `register_v2_route`; the WebSocket handler registry gains a
+  dedicated `registered_ws_handlers_mutex_`. Callers observe no
+  behavioural change.
 
 ## What's new
 
@@ -178,11 +204,7 @@ and see the v2 replacement.
   (earlier v2 work-in-progress shipped
   `std::function<std::shared_ptr<http_response>(const http_request&)>`).
   Return `std::nullopt` to allow the request; return an `http_response`
-  to reject. The v1 `shared_ptr` shape still compiles via
-  `httpserver::compat::auth_handler_v1_ptr` and a `[[deprecated]]`
-  setter overload (both emit a deprecation warning); the compat alias
-  and overload are scheduled for removal in v2.1.
-  Removes one heap allocation per authenticated request.
+  to reject. Removes one heap allocation per authenticated request.
 - **`http_request` getters return `const&` / `string_view`.** v1's
   `get_header(name)` (and `get_arg`, `get_cookie`, `get_footer`) returned
   by value and inserted an empty entry into the request map on miss; v2's

specs/architecture/04-components/route-table.md

@@ -27,6 +27,6 @@ A `route_entry` carries:
 
 **Related requirements:** PRD-HDL-REQ-002, PRD-HDL-REQ-004, PRD-HDL-REQ-006.
 
-**Implementation status:** TASK-025 introduced `detail::route_entry` and the `lambda_resource` shim into the existing v1 three-map storage shape. TASK-027 wired `route_entry` into the full 3-tier table described above (hash map for exact paths, radix tree for parameterized/prefix paths, regex chain for regex routes). TASK-053 retired the v1 dispatch path: `webserver_impl::resolve_resource_for_request` now consults `lookup_v2()` (cache → exact → radix → regex) directly, the v1 LRU cache and the four v1 lookup helpers (`lookup_route_cache`, `scan_regex_routes`, `store_route_cache`, `apply_extracted_params`) are deleted, and the LRU cache field is renamed `route_lru_cache`. The v1 registration-side maps (`registered_resources`, `registered_resources_str`, `registered_resources_regex`) survive *only* as registration-time bookkeeping for `prepare_or_create_lambda_shim` (lambda/class conflict detection) and the WebSocket dispatch path, both of which are non-HTTP-dispatch concerns; their removal is its own follow-up task. TASK-056 swapped the radix-node child container from `std::unordered_map` to `std::map<…, std::less<>>` for CWE-407 immunity and added registration-time detection of prefix-vs-exact terminus collisions (`reject_terminus_collision`).
+**Implementation status:** TASK-025 introduced `detail::route_entry` and the `lambda_resource` shim into the existing v1 three-map storage shape. TASK-027 wired `route_entry` into the full 3-tier table described above (hash map for exact paths, radix tree for parameterized/prefix paths, regex chain for regex routes). TASK-053 retired the v1 dispatch path: `webserver_impl::resolve_resource_for_request` now consults `lookup_v2()` (cache → exact → radix → regex) directly, the v1 LRU cache and the four v1 lookup helpers (`lookup_route_cache`, `scan_regex_routes`, `store_route_cache`, `apply_extracted_params`) are deleted, and the LRU cache field is renamed `route_lru_cache`. **TASK-067** deleted the v1 registration-side maps (`registered_resources`, `registered_resources_str`, `registered_resources_regex`) and their shared mutex; the v2 3-tier table is now the only routing surface end-to-end. Lambda/class path-conflict detection (`prepare_or_create_lambda_shim`) probes the v2 tiers via `find_v2_entry_by_path_`; the WebSocket registration map keeps its own `registered_ws_handlers_mutex_`. TASK-056 swapped the radix-node child container from `std::unordered_map` to `std::map<…, std::less<>>` for CWE-407 immunity and added registration-time detection of prefix-vs-exact terminus collisions (`reject_terminus_collision`).
 
 ---

specs/tasks/M7-v2-cleanup/TASK-067.md

@@ -34,4 +34,4 @@ Cut them in a single, well-tested PR so the v2 dispatch path is the only one.
 **Related Requirements:** PRD §2 API minimalism, PRD §1 release strategy
 **Related Decisions:** DR-007, DR-011
 
-**Status:** Backlog
+**Status:** Done

specs/tasks/M7-v2-cleanup/_index.md

@@ -31,7 +31,7 @@ TASK-093).
 | TASK-064 | Structured cookie type | HIGH | M | Backlog |
 | TASK-065 | RFC 5952 IPv6 zero-compression in `peer_address` | HIGH | S | Done |
 | TASK-066 | Runtime setter for hook alias slots | MED | M | Backlog |
-| TASK-067 | Remove v1 `registered_resources*` maps and `namespace compat` shim | MED | L | Backlog |
+| TASK-067 | Remove v1 `registered_resources*` maps and `namespace compat` shim | MED | L | Done |
 | TASK-068 | `connection_state` hardening — CWE-226 / CWE-14 | MED | S | Backlog |
 | TASK-069 | Remove transitional two-arg `http_request_impl` constructor | MED | S | Backlog |
 | TASK-070 | Migrate `hook_table_` to `std::atomic<std::shared_ptr<T>>` | MED | M | Backlog |

src/detail/webserver_dispatch.cpp

@@ -259,34 +259,14 @@ webserver_impl::lookup_v2(http_method method, const std::string& path) {
 //       (the on_*/route entry points wrap user lambdas in lambda_resource
 //       before storing; the variant's lambda_handler arm is dead code).
 //
-// The parent->single_resource fast path is intentionally preserved
-// here: it reads the single registered endpoint directly from
-// registered_resources rather than falling through to lookup_v2 (which
-// would also work because single_resource installs a radix prefix at
-// "/"). Reading registered_resources avoids the captured-params /
-// route_entry plumbing for a configuration that has no parameters.
-// single_resource fast path: the one registered endpoint serves every
-// URL. Read it directly from registered_resources.
-// registered_resources_mutex protects a registration-time data store;
-// under dispatch we still need a shared lock to make the read-then-copy
-// atomic with respect to a concurrent unregister_path. (single_resource
-// webservers do not support runtime register/unregister in practice,
-// but the lock is cheap when uncontended and the safety guarantee is
-// worth it.) Returns false when no resource is registered yet.
-bool webserver_impl::resolve_single_resource_(detail::modded_request* mr,
-        std::shared_ptr<http_resource>& hrm,
-        bool need_path_template) {
-    std::shared_lock registered_resources_lock(registered_resources_mutex);
-    if (registered_resources.empty()) return false;
-    const auto& only = *registered_resources.begin();
-    hrm = only.second;
-    if (need_path_template) {
-        mr->matched_path_template = only.first.get_url_complete();
-        mr->matched_is_prefix = only.first.is_family_url();
-    }
-    return true;
-}
-
+// TASK-067: single_resource mode used to short-circuit to a direct read
+// of the v1 registered_resources map. With the v1 maps deleted, single
+// resource servers register their handler via register_prefix("")
+// or register_prefix("/") -- both surface as a radix-tier prefix
+// terminus at "/", which lookup_v2 finds on the radix-tier walk. There
+// is no separate fast path because the v2 walk for a single registered
+// prefix is one shared_lock + one empty-map probe + one trivial radix
+// descent: cheap enough that the extra branch was net-negative.
 bool webserver_impl::resolve_resource_for_request(detail::modded_request* mr,
         std::shared_ptr<http_resource>& hrm) {
     // matched_path_template + matched_is_prefix feed the route_resolved
@@ -296,10 +276,6 @@ bool webserver_impl::resolve_resource_for_request(detail::modded_request* mr,
         has_hooks_for(hook_phase::route_resolved) ||
         has_hooks_for(hook_phase::before_handler);
 
-    if (parent->single_resource) {
-        return resolve_single_resource_(mr, hrm, need_path_template);
-    }
-
     // v2 lookup pipeline: cache -> exact -> radix -> regex.
     lookup_result result = lookup_v2(mr->method_enum, mr->standardized_url);
     if (!result.found) return false;