TASK-061: mechanical cleanup sweep — unfinished prose, orphan comments, stale doc references

- src/detail/webserver_register.cpp: complete the truncated TASK-029
  block comment with the missing closing clause
  ("they are no longer reachable from the public API.").
- src/detail/webserver_register.cpp: install the full TASK-024 prologue
  (six lines, ending "dangling resource pointer after the maps drop
  their refs.") immediately above webserver::unregister_impl_, the
  function the comment actually describes.
- src/detail/webserver_setup.cpp: remove the orphaned five-line
  TASK-024 head that was sitting above the unrelated block_ip
  (split-artifact from the 7-way webserver.cpp split).
- src/webserver.cpp:503-504: remove the two orphan comment fragments
  left after removed logic ("dangling resource pointer..." and
  "they are no longer reachable...") — both lines now have a single
  canonical home in webserver_register.cpp after the steps above.
- test/Makefile.am:73-74: replace the stale "Currently in XFAIL_TESTS"
  claim with a status-correct "Now an unconditional PASS" note that
  cross-references the existing TASK-020 block at lines 533-536.
- scripts/check-readme.sh:273: drop the stale
  "RELEASE_NOTES.md) continue ;;  # created by TASK-042, not yet
  present" case arm — TASK-042 shipped, the file now exists, and the
  generic existence check at the bottom of the loop handles it.
- test/littletest.hpp: left untouched per planning decision (vendored
  upstream liblittletest header, no fork policy authorising in-place
  edits to stylistic comments).

Verification:
- make check: 87/87 PASS, 0 FAIL.
- check-file-size: PASS (FILE_LOC_MAX=750).
- check-readme.sh: returns 0 end-to-end.
- All five pre-edit failing grep guards now report zero matches.
- Each of the three reflowed sentence fragments has exactly one
  canonical copy under src/.

Pre-existing on feature/v2.0 (NOT introduced by this task): the
check-doxygen.sh gate fails with seven warnings against unrelated
headers (create_webserver.hpp, hook_context.hpp,
webserver_websocket.hpp — none of which TASK-061 touches). Confirmed
by running check-doxygen against an unchanged feature/v2.0 checkout
and reproducing the same output.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: etr

scripts/check-readme.sh

@@ -270,7 +270,6 @@ while IFS= read -r target; do
     case "$target" in
         http://*|https://*) continue ;;         # absolute URLs — not checked
         \#*)                continue ;;         # in-page anchors — not checked
-        RELEASE_NOTES.md)   continue ;;         # created by TASK-042, not yet present
     esac
     # Strip fragment identifiers (#section) before existence check to avoid
     # false failures when a link like [foo](examples/foo.cpp#line) is added.

src/detail/webserver_register.cpp

@@ -244,6 +244,12 @@ void webserver::register_resource(const std::string& resource,
     register_path(resource, std::move(res));
 }
 
+// TASK-024: erase a single registration of the requested kind (family).
+// Each kind keeps a distinct http_endpoint key (the family flag is part
+// of the endpoint's identity), so we must build the key with the right
+// flag or the erase silently misses. Caches are invalidated under the
+// registered_resources lock to prevent any thread from reading a
+// dangling resource pointer after the maps drop their refs.
 void webserver::unregister_impl_(const string& resource, bool family) {
     detail::http_endpoint he(resource, family, true, regex_checking);
 
@@ -346,5 +352,6 @@ void webserver::unregister_resource(const string& resource) {
 // collapsed to a single name pair operating on the deny list. The internal
 // allowances set and the allow-list branch in policy_callback remain in
 // place so default_policy(REJECT) keeps working at the daemon level, but
+// they are no longer reachable from the public API.
 
 }  // namespace httpserver

src/detail/webserver_setup.cpp

@@ -438,11 +438,6 @@ bool webserver::add_connection(int client_socket, const struct sockaddr* addr, u
                               static_cast<socklen_t>(addrlen)) == MHD_YES;
 }
 
-// TASK-024: erase a single registration of the requested kind (family).
-// Each kind keeps a distinct http_endpoint key (the family flag is part
-// of the endpoint's identity), so we must build the key with the right
-// flag or the erase silently misses. Caches are invalidated under the
-// registered_resources lock to prevent any thread from reading a
 void webserver::block_ip(std::string_view ip) {
     std::unique_lock bans_lock(impl_->bans_mutex);
     ip_representation t_ip{std::string{ip}};

src/webserver.cpp

@@ -499,11 +499,4 @@ hook_handle webserver::add_hook(hook_phase phase,
         impl_->hooks_connection_closed_, std::move(fn));
 }
 
-
-// dangling resource pointer after the maps drop their refs.
-// they are no longer reachable from the public API.
-
-
-
-
 }  // namespace httpserver

test/Makefile.am

@@ -70,8 +70,9 @@ header_hygiene_iovec_SOURCES = unit/header_hygiene_iovec_test.cpp
 #   passed so <httpserver.hpp> resolves.
 # - LDADD is overridden to empty: this is a pure-compile assertion, the
 #   `int main(){}` body has no library dependencies.
-# Currently in XFAIL_TESTS (see below); flips to PASS when M5 lands and
-# the umbrella is free of backend-header leakage.
+# Now an unconditional PASS: TASK-020 landed and the <httpserver.hpp>
+# umbrella is free of backend-header leakage. See lines ~532-535 below
+# for the historical XFAIL_TESTS note.
 header_hygiene_SOURCES = unit/header_hygiene_test.cpp
 header_hygiene_CPPFLAGS = -I$(top_srcdir)/src $(CPPFLAGS)
 header_hygiene_LDADD =