TASK-013: housekeeping (status + checkboxes + arch sync + review record)

- Mark TASK-013 status as Done (matches the convention used by all other
  M2 tasks; addresses housekeeper-iter1-16) and tick off the six action
  items now satisfied by the implementation commit.
- Sync specs/tasks/_index.md row from "Not Started" → "Done".
- Sync specs/architecture/04-components/http-response.md to reflect the
  sealed `final` http_response and the ref-qualified `& / &&` `with_*`
  setter overloads added in TASK-009/TASK-012.
- Record the 33 unworked findings (1 major, 32 minor) from the validation
  pass in specs/unworked_review_issues/2026-05-04_013108_task-013.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: etr

specs/architecture/04-components/http-response.md

@@ -2,7 +2,7 @@
 
 **Responsibility:** Describe the response a handler wants to send: status, headers, footers, cookies, body. Constructed by user code via factories; consumed by library dispatch which materializes an `MHD_Response*` from it.
 
-**Implementation:** **Non-PIMPL value type.** Public header carries the data members directly:
+**Implementation:** **Non-PIMPL value type, declared `final` (sealed per PRD §3.5).** Inheritance is prevented at compile time; `static_assert(std::is_final_v<httpserver::http_response>)` is exercised in the SBO unit test. Public header carries the data members directly:
 - `int status_code`
 - `http::header_map headers`, `footers`, `cookies` (separate maps; cookies kept distinct from headers for v2.0 API compatibility)
 - `body_kind kind_` enum (`empty`, `string`, `file`, `iovec`, `pipe`, `deferred`)
@@ -21,7 +21,7 @@ The body subclasses (`detail::string_body`, `file_body`, `iovec_body`, `pipe_bod
 - Exposes (from PRD §3.5):
   - Factories: `http_response::string(...)`, `::file(...)`, `::iovec(std::span<const httpserver::iovec_entry>)`, `::pipe(...)`, `::empty(...)`, `::deferred(...)`, `::unauthorized(scheme, realm, ...)` — all return `http_response` by value.
   - **`httpserver::iovec_entry`** is a library-defined POD declared in `<httpserver/http_response.hpp>`: `struct iovec_entry { const void* base; std::size_t len; };`. It mirrors POSIX `struct iovec` exactly in layout but does not require `<sys/uio.h>` in any installed header. The internal dispatch path uses the user-supplied span to build a `struct iovec` array inside `iovec_body`. The implementation file (`detail/body.hpp` / `http_response.cpp`) carries `static_assert`s pinning the layout assumption: `static_assert(sizeof(iovec_entry) == sizeof(struct iovec))`, `static_assert(offsetof(iovec_entry, base) == offsetof(struct iovec, iov_base))`, `static_assert(offsetof(iovec_entry, len) == offsetof(struct iovec, iov_len))`. When the asserts hold, conversion is a `reinterpret_cast`; when they fail (a hypothetical platform with divergent layout), the build fails loudly at compile time and we fall back to memcpy. This keeps the public header free of system headers and makes the API uniformly available on platforms where `<sys/uio.h>` is not standard (e.g., MSVC builds).
-  - Fluent setters: `with_header`, `with_footer`, `with_cookie`, `with_status` — return `http_response&`.
+  - Fluent setters: `with_header`, `with_footer`, `with_cookie`, `with_status` — each has two ref-qualified overloads: `& → http_response&` (mutate-in-place on an lvalue) and `&& → http_response&&` (return the object by rvalue-reference for zero-copy rvalue factory chains, e.g. `http_response::string("body").with_header("X-Foo", "bar").with_status(201)`).
   - `const` accessors: `get_header`, `get_footer`, `get_cookie` returning `string_view` (empty on miss; do not insert).
   - `get_headers`, `get_footers`, `get_cookies` returning `const map&`.
   - `kind()` returning `body_kind`.

specs/tasks/M2-response/TASK-013.md

@@ -8,12 +8,12 @@
 Delete the public-facing response subclasses and the `get_raw_response`/`decorate_response`/`enqueue_response` virtuals so the new factory-based surface is the only way to build a response.
 
 **Action Items:**
-- [ ] Remove `src/httpserver/string_response.hpp`, `file_response.hpp`, `iovec_response.hpp`, `pipe_response.hpp`, `deferred_response.hpp`, `empty_response.hpp`, `basic_auth_fail_response.hpp`, `digest_auth_fail_response.hpp` from the installed set.
-- [ ] Delete those classes' source files (or move any salvageable logic into `detail/body.hpp`).
-- [ ] Remove the public virtual methods `get_raw_response`, `decorate_response`, `enqueue_response` from `http_response.hpp`.
-- [ ] Update `<httpserver.hpp>` umbrella to drop the removed includes.
-- [ ] Internal dispatch path (in `webserver.cpp` or `http_response.cpp`) calls `body_->materialize(...)` instead of the removed virtuals.
-- [ ] Add `final` to `http_response` (deferred from TASK-009 because the v1 subclasses still inherited at that point — see TASK-009 plan OQ-1). Per PRD §3.5 the class must be sealed.
+- [x] Remove `src/httpserver/string_response.hpp`, `file_response.hpp`, `iovec_response.hpp`, `pipe_response.hpp`, `deferred_response.hpp`, `empty_response.hpp`, `basic_auth_fail_response.hpp`, `digest_auth_fail_response.hpp` from the installed set.
+- [x] Delete those classes' source files (or move any salvageable logic into `detail/body.hpp`).
+- [x] Remove the public virtual methods `get_raw_response`, `decorate_response`, `enqueue_response` from `http_response.hpp`.
+- [x] Update `<httpserver.hpp>` umbrella to drop the removed includes.
+- [x] Internal dispatch path (in `webserver.cpp` or `http_response.cpp`) calls `body_->materialize(...)` instead of the removed virtuals.
+- [x] Add `final` to `http_response` (deferred from TASK-009 because the v1 subclasses still inherited at that point — see TASK-009 plan OQ-1). Per PRD §3.5 the class must be sealed.
 
 **Dependencies:**
 - Blocked by: TASK-009, TASK-010, TASK-011, TASK-012
@@ -30,4 +30,4 @@ Delete the public-facing response subclasses and the `get_raw_response`/`decorat
 **Related Requirements:** PRD-RSP-REQ-006, PRD-HDR-REQ-005
 **Related Decisions:** §4.3, §4.8
 
-**Status:** Not Started
+**Status:** Done

specs/tasks/_index.md

@@ -95,7 +95,7 @@ Nominally: **13 sequential tasks**, each S–XL. Most other tasks parallelize of
 | TASK-010 | `http_response` factory functions | M2 | Done | TASK-008, TASK-009, TASK-004 |
 | TASK-011 | `http_response` const-correct accessors | M2 | Done | TASK-009 |
 | TASK-012 | `http_response` fluent `with_*` setters | M2 | Done | TASK-009 |
-| TASK-013 | Remove `*_response` subclasses and dispatch virtuals | M2 | Not Started | TASK-009, TASK-010, TASK-011, TASK-012 |
+| TASK-013 | Remove `*_response` subclasses and dispatch virtuals | M2 | Done | TASK-009, TASK-010, TASK-011, TASK-012 |
 | TASK-014 | `webserver_impl` skeleton (PIMPL prep) | M3 | Not Started | TASK-002 |
 | TASK-015 | `http_request_impl` skeleton (PIMPL split) | M3 | Not Started | TASK-002, TASK-014 |
 | TASK-016 | Per-connection arena for `http_request_impl` | M3 | Not Started | TASK-014, TASK-015 |