## Bugs

### `Static_Context` never freed
**File:** `lib/net/http/router/router.odin:114–118`

```odin
ctx := new(Static_Context)                          // TODO: cleanup of memory
ctx.root, _ = os.get_absolute_path(...)
ctx.base_path = strings.clone(path)                 // TODO: cleanup of memory
```

These are per-route allocations with no path to freedom. `router.destroy` does not
iterate routes. Not a runtime leak in practice (application-lifetime), but shows up
under a tracking allocator and prevents clean shutdown reporting.

**Fix:** Add a `destroy_route` helper that frees route-specific context, call it from
`router.destroy`.

---

## Suggested architectural direction

Most of the per-request `defer delete` complexity, the double-free risk, and the
double-allocation waste can be eliminated by introducing a **per-request arena**:

- Allocate a small arena at the top of the `conn_handle` request loop.
- Use it as `context.allocator` for the duration of one request.
- All request-scoped data (`_raw_head`, `body`, headers, params, response body) lives
  in the arena.
- At end of request, `free_all` the arena. No individual frees needed, no ownership
  ambiguity.
- The `respond_*` clone becomes unnecessary — handlers write into arena memory and
  the HTTP layer sends from it directly.