TASK-064: document live-MHD and deprecated negative-compile coverage gaps

test-quality-reviewer-iter3-4: Add comment to second_call_does_not_reallocate
explaining that the cookies_parsed_cache_ guard via the create_test_request()
builder path is tested, but the live MHD_get_connection_values path is only
covered by integration tests.

test-quality-reviewer-iter3-5: Expand comment in cookie_deprecation_sentinel_test
recording that the CMake try_compile() negative-compile sentinel (confirming
[[deprecated]] is emitted with -Werror) is a pending follow-up. Points to the
cookie_header_sentinel_test.cpp pattern as the available infrastructure.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: etr

test/unit/cookie_deprecation_sentinel_test.cpp

@@ -30,6 +30,13 @@
 // in this comment and rely on the existing CI warning-summary step plus
 // the spot-checked grep in scripts/check-doxygen.sh.
 //
+// test-quality-reviewer-iter3-5: mechanical verification of the negative
+// compile (i.e. a CMake try_compile() sentinel that confirms
+// with_cookie(string,string) emits -Wdeprecated-declarations with -Werror)
+// is recorded as a follow-up task. The cookie_header_sentinel_test.cpp
+// pattern shows the project has infrastructure for compile-only tests;
+// the CMake-side negative-compile harness is the missing piece.
+//
 // Pure compile test -- empty LDADD.
 
 #include <string>

test/unit/http_request_cookies_parsed_test.cpp

@@ -95,6 +95,13 @@ LT_END_AUTO_TEST(reference_stable_across_calls)
 
 LT_BEGIN_AUTO_TEST(http_request_cookies_parsed_suite,
                    second_call_does_not_reallocate)
+    // This test exercises the cookies_parsed_cache_ guard via the
+    // create_test_request() builder path (cookies_parsed_cache_built_
+    // is set during build). The live MHD path — where
+    // cookies_parsed_cache_built_ is set on the first MHD_get_connection_values
+    // call — is only exercised by integration tests (test/integ/).
+    // See test-quality-reviewer-iter3-4: the live-MHD branch is accepted
+    // as integration-test-only coverage.
     http_request req = create_test_request()
         .path("/").method("GET")
         .cookie("sid", "abc")