TASK-036 review: fix callback=nullptr and counter isolation

- Add = nullptr default initializer to modded_request::callback field,
  eliminating UB per the C++ standard (findings 1 & 5: code-quality-
  reviewer + code-simplifier). The is_allowed guard already prevents
  the pointer from being invoked for unrecognized methods; this makes
  the contract explicit at the declaration site.
- Update the comment in resolve_method_callback to remove the stale
  "pre-existing latent bug" note now that callback has a safe default.
- Add per-test counter reset at the start of the three deferred tests
  that share the static counter (finding 12: test-quality-reviewer).
  tear_down() also resets but cannot guarantee ordering when tests run
  in non-default order or under skip conditions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: etr

src/detail/webserver_request.cpp

@@ -366,8 +366,9 @@ void webserver_impl::resolve_method_callback(const char* method,
     // call hrm->is_allowed without re-scanning the wire string.
     // Unrecognised methods leave mr->method_enum at the default
     // (count_), so is_allowed(count_) returns false and the request
-    // takes the 405 path. Pre-existing latent bug: mr->callback may
-    // also be left un-set here; see TASK-027 for the dispatch redesign.
+    // takes the 405 path. mr->callback is left at nullptr (its
+    // default-initializer value) for unrecognised methods; the 405 guard
+    // in dispatch_resource_handler fires before it is ever invoked.
     if (0 == strcmp(method, http_utils::http_method_get)) {
         mr->callback = &http_resource::render_get;
         mr->method_enum = http_method::get;

src/httpserver/detail/modded_request.hpp

@@ -48,8 +48,11 @@ struct modded_request {
     webserver* ws = nullptr;
 
     // TASK-036: pointer-to-member dispatch slot; render_* now return
-    // http_response by value (PRD-RSP-REQ-007 / DR-004).
-    http_response (httpserver::http_resource::*callback)(const httpserver::http_request&);
+    // http_response by value (PRD-RSP-REQ-007 / DR-004). Initialized to
+    // nullptr; set by resolve_method_callback for recognized HTTP methods.
+    // For unrecognized methods mr->method_enum is left at count_ and
+    // finalize_answer takes the 405 path before invoking this pointer.
+    http_response (httpserver::http_resource::*callback)(const httpserver::http_request&) = nullptr;
 
     // TASK-021: enum form of the wire method, decoded once at the
     // dispatch boundary in webserver_impl::answer_to_connection. Used

test/integ/deferred.cpp

@@ -189,6 +189,7 @@ LT_BEGIN_SUITE(deferred_suite)
 LT_END_SUITE(deferred_suite)
 
 LT_BEGIN_AUTO_TEST(deferred_suite, deferred_response_suite)
+    counter = 0;  // reset per-test; tear_down also resets but order may vary
     deferred_resource resource;
     ws->register_path("base", as_shared(resource));
     curl_global_init(CURL_GLOBAL_ALL);
@@ -207,6 +208,7 @@ LT_BEGIN_AUTO_TEST(deferred_suite, deferred_response_suite)
 LT_END_AUTO_TEST(deferred_response_suite)
 
 LT_BEGIN_AUTO_TEST(deferred_suite, deferred_response_with_data)
+    counter = 0;  // reset per-test; tear_down also resets but order may vary
     deferred_resource_with_data resource;
     ws->register_path("base", as_shared(resource));
     curl_global_init(CURL_GLOBAL_ALL);
@@ -225,6 +227,7 @@ LT_BEGIN_AUTO_TEST(deferred_suite, deferred_response_with_data)
 LT_END_AUTO_TEST(deferred_response_with_data)
 
 LT_BEGIN_AUTO_TEST(deferred_suite, deferred_response_empty_content)
+    counter = 0;  // reset per-test; tear_down also resets but order may vary
     deferred_resource_empty_content resource;
     ws->register_path("base", as_shared(resource));
     curl_global_init(CURL_GLOBAL_ALL);