fulmine.js 5.2.0 → 5.3.0

package/src/router.js

@@ -2,6 +2,8 @@
 Copyright 2024 dimden.dev
 Copyright 2026 Nigro Simone
 
+This file is derived from Ultimate Express and has been modified.
+
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
@@ -17,7 +19,6 @@ limitations under the License.
 
 const {
     patternToRegex,
-    escapePathLiteral,
     getPatternMeta,
     decodeParam,
     needsConversionToRegex,
@@ -36,9 +37,70 @@ const compileDeclarative = require("./declarative.js");
 const statuses = require("statuses");
 const { METHODS } = require("http");
 const { isNodeRequest, serveNodeRequest } = require("./node-shim.js");
-const { chainUsage } = require("./usage.js");
+const { chainUsage, kGetSafe } = require("./usage.js");
 const { checkBehavior } = require("./websocket.js");
 
+// whether a registered path could be asked for in another case, which is what decides whether the
+// native router can be trusted to prefer it, see _optimizeRoute
+const HAS_LETTER = /[a-zA-Z]/;
+
+// hands out one number per app.route(), so the routes it creates know they belong together
+let routeGroups = 0;
+
+/**
+ * Whether an earlier route would have answered this path had case not mattered. A guard is a
+ * folded string when the earlier path is a literal, and an insensitive pattern when it has
+ * parameters of its own.
+ *
+ * The string side is compared character by character rather than through toLowerCase, because it
+ * sits on the hot path of every parameter route that has an earlier literal, and saying no must
+ * allocate nothing.
+ *
+ * @param {(string|RegExp)[]} guards
+ * @param {string} path the path as it arrived
+ * @returns {boolean}
+ */
+function anyGuardHits(guards, path) {
+    for (let i = 0; i < guards.length; i++) {
+        const guard = guards[i];
+        if (typeof guard !== "string") {
+            if (guard.test(path)) {
+                return true;
+            }
+            continue;
+        }
+        // the guard is a registered path, which under the default routing answers the same path
+        // with one trailing slash as well: "/x1" registered is what serves "/x1/", so "/X1/" is
+        // just as much a case variant of it as "/X1" is. Missing that answered "/X1/" from the
+        // parameter route behind it while express answered from the literal.
+        //
+        // The regex guards, for earlier paths that carry parameters of their own, are built
+        // non-strict and already accept it. Erring wide costs nothing here either: a guard that
+        // hits only hands the request to the generic router, which is where express's own order
+        // decides anyway
+        const slashed = path.length === guard.length + 1 && path.charCodeAt(guard.length) === 0x2f;
+        if (guard.length !== path.length && !slashed) {
+            continue;
+        }
+        let same = true;
+        for (let j = 0; j < guard.length; j++) {
+            let code = path.charCodeAt(j);
+            // A to Z only, which is the fold express's insensitive routing does
+            if (code >= 65 && code <= 90) {
+                code += 32;
+            }
+            if (code !== guard.charCodeAt(j)) {
+                same = false;
+                break;
+            }
+        }
+        if (same) {
+            return true;
+        }
+    }
+    return false;
+}
+
 // every method the declarative compiler can emit: a patched one must disable compilation, or the
 // patch would be honoured everywhere but on compiled routes
 const resCodes = {},
@@ -89,6 +151,29 @@ class Walk {
         // bound, not wrapped in an arrow: an arrow forwarding into step() is one more call on every
         // hop, and it measured 495 microseconds per thousand requests of nothing else
         this.next = this.step.bind(this);
+        // What res.sendFile reports a failure to. Express hands it req.next, which is the router
+        // next and not the route one, so a file that cannot be served leaves the route and its
+        // error reaches the router error handlers rather than a four argument handler written
+        // inside the route. req.next itself is left alone: making it mean this everywhere is what
+        // express does, and it breaks express own res.format and app.routes.error tests here, so
+        // that stays open rather than half done.
+        this.leaveRoute = this.stepOutOfRoute.bind(this);
+    }
+
+    /**
+     * Leaves the rest of this route, with the error if there is one, and carries on with the route
+     * after it.
+     *
+     * @param {any} [err]
+     */
+    stepOutOfRoute(err) {
+        if (err) {
+            const req = this.req;
+            req._error = err;
+            req._errorKey = this.route.routeKey;
+            req._errorGroup = this.route.group;
+        }
+        this.step("route");
     }
 
     /**
@@ -108,15 +193,40 @@ class Walk {
             return;
         }
         let routeIndex = startIndex;
+        // a compiled chain runs what is in it without matching again, so this is where a layer that
+        // provably has nothing to do for this request is stepped over rather than entered
+        if (this.skipCheck) {
+            while (routeIndex < routes.length && routes[routeIndex].bodyParserOnly === true) {
+                if (!stepsOver(routes[routeIndex], req)) {
+                    break;
+                }
+                routeIndex++;
+            }
+        }
         if (!this.skipCheck) {
+            // express matches a layer's path before it looks at the method, and decodes the
+            // parameters there, so a malformed escape answers 400 even when no route of this
+            // method exists. Only a path carrying a percent can produce one, and that check keeps
+            // every other request from matching routes it could never run
+            const mayFailDecode = req._originalPath.indexOf("%") !== -1;
             // written out rather than through a predicate handed to findIndexStartingFrom, which
             // was one closure per hop of every request not on a compiled chain
             for (; routeIndex < routes.length; routeIndex++) {
                 const r = routes[routeIndex];
-                if (
-                    (r.all || r.method === req.method || req._isOptions || (r.gettable && req._isHead)) &&
-                    router._pathMatches(r, req)
-                ) {
+                if (!(r.all || r.method === req.method || req._isOptions || (r.gettable && req._isHead))) {
+                    // taken only to fail: _preprocessRequest decodes again and turns it into the
+                    // error, so the handlers of a route this request cannot run never see it
+                    if (mayFailDecode && router._pathMatches(r, req) && router._paramsFailToDecode(r, req)) {
+                        break;
+                    }
+                    continue;
+                }
+                if (router._pathMatches(r, req)) {
+                    // matched, and then stepped over: a body parser this request gets nothing out
+                    // of costs a hop and answers with next() at the end of it
+                    if (r.bodyParserOnly === true && stepsOver(r, req)) {
+                        continue;
+                    }
                     break;
                 }
             }
@@ -134,19 +244,14 @@ class Walk {
             // path is still relative to it. /alone/skip must not be offered to the app as /skip
             if (req._stack !== null && req._stack.length > 0) {
                 req._stack.length = 0;
-                req._stackMounted = 0;
-                req.path = req._originalPath;
-                req.url = req._originalPath + req.urlQuery;
-                req._opPath =
-                    req.endsWithSlash && req._originalPath !== "/" && !router.get("strict routing")
-                        ? req._originalPath.slice(0, -1)
-                        : req._originalPath;
-                req._lastUrl = req.url;
+                req._consumed = 0;
+                setMountedPath(req);
             }
             // an error out of a mount is attributed to the mount, so error handlers declared before
             // it do not catch it, as in ordinary dispatch
             if (req._error && this.skipUntil && this.skipUntil.keepMount && this.skipUntil.routeKey > req._errorKey) {
                 req._errorKey = this.skipUntil.routeKey;
+                req._errorGroup = this.skipUntil.group;
             }
             this.routes = router._routes;
             this.skipCheck = false;
@@ -192,14 +297,8 @@ class Walk {
         this.skipUntil = startIndex > 0 ? this.routes[startIndex - 1] : undefined;
         if (req._stack !== null && req._stack.length > 0) {
             req._stack.length = 0;
-            req._stackMounted = 0;
-            req.path = req._originalPath;
-            req.url = req._originalPath + req.urlQuery;
-            req._opPath =
-                req.endsWithSlash && req._originalPath !== "/" && !router.get("strict routing")
-                    ? req._originalPath.slice(0, -1)
-                    : req._originalPath;
-            req._lastUrl = req.url;
+            req._consumed = 0;
+            setMountedPath(req);
         }
         this.routes = router._routes;
         this.skipCheck = false;
@@ -216,37 +315,25 @@ class Walk {
     runRoute(continueRoute) {
         const req = this.req;
         const route = this.route;
-        const router = this.router;
         if (route.use) {
             if (route.mountApp) {
                 // optimized chain: normal dispatch swaps req.app when it enters a mounted
                 // Application, but the compiled mount route has no callback to do it
+                rememberApp(this, route, req);
                 useApp(req, route.mountApp);
             }
-            (req._stack ??= []).push(route.regexMount ? regexMountEntry(router, route, req) : route.path);
+            const taken = mountPrefixLength(route, req);
+            (req._stack ??= []).push(taken);
             // a use with no path consumes nothing, so everything below would work out the values
             // that are already there. Only skipped without a trailing slash, where the rules about
             // one cannot bite. An application is mostly pathless middleware, and this is per hop
-            if (route.path !== "" || req.endsWithSlash) {
-                if (route.path !== "") {
-                    req._stackMounted++;
-                }
-                const fullMountpath = router.getFullMountpath(req);
-                req._opPath =
-                    fullMountpath !== EMPTY_REGEX ? req._originalPath.replace(fullMountpath, "") : req._originalPath;
-                if (req.endsWithSlash && req._opPath[req._opPath.length - 1] !== "/") {
-                    req._opPath = router.get("strict routing") ? req._opPath + "/" : req._opPath.slice(0, -1);
-                }
-                req.url = req._opPath + req.urlQuery;
-                req.path = req._opPath;
-                if (req._opPath === "") {
-                    req.url = "/" + req.urlQuery;
-                    req.path = "/";
-                }
-                req._lastUrl = req.url;
+            if (taken !== 0 || req.endsWithSlash) {
+                req._consumed += taken;
+                setMountedPath(req);
             }
         }
         req.next = this.next;
+        req._leaveRoute = this.leaveRoute;
         if (continueRoute === "route") {
             this.step("route");
         } else if (continueRoute) {
@@ -266,7 +353,15 @@ class Walk {
     errorHop(kind, callback) {
         const req = this.req;
         const route = this.route;
-        if (req._error && kind === CALLBACK_ERROR && route.routeKey >= req._errorKey) {
+        // A four argument handler written inside a route only ever sees what that route raised:
+        // express skips a route layer entirely while an error is in flight, so an error from a
+        // middleware before it, or out of a mount, walks past to the router's own error handlers.
+        // Middleware error handlers keep the ordinary rule, which is that they catch what was
+        // raised before them.
+        const reachable = route.use
+            ? route.routeKey >= req._errorKey
+            : route.routeKey === req._errorKey || (route.group !== undefined && route.group === req._errorGroup);
+        if (req._error && kind === CALLBACK_ERROR && reachable) {
             const out = this.router._handleError(req._error, callback, req, this.res);
             if (out instanceof Promise) {
                 // an error handler's rejected promise moves on to the next error handler, and
@@ -274,6 +369,7 @@ class Walk {
                 out.catch((err) => {
                     req._error = err || new Error("Rejected promise");
                     req._errorKey = route.routeKey;
+                    req._errorGroup = route.group;
                     return this.step(undefined);
                 });
             }
@@ -301,45 +397,20 @@ class Walk {
                     if (req.url !== req._lastUrl) {
                         req._absorbUrlRewrite();
                     }
-                    if (req._stack.pop() !== "") {
-                        req._stackMounted--;
-                    }
-
-                    const strictRouting = router.get("strict routing");
-                    const poppedMountpath = req._stack.length > 0 ? router.getFullMountpath(req) : EMPTY_REGEX;
-                    req._opPath =
-                        poppedMountpath !== EMPTY_REGEX
-                            ? req._originalPath.replace(poppedMountpath, "")
-                            : req._originalPath;
-                    if (strictRouting) {
-                        if (req.endsWithSlash && req._opPath[req._opPath.length - 1] !== "/") {
-                            req._opPath += "/";
-                        }
-                    }
-                    req.url = req._opPath + req.urlQuery;
-                    req.path = req._opPath;
-                    if (req._opPath === "") {
-                        req.url = "/" + req.urlQuery;
-                        req.path = "/";
-                    }
-                    req._lastUrl = req.url;
-                    if (
-                        !strictRouting &&
-                        req.endsWithSlash &&
-                        req._originalPath !== "/" &&
-                        req._opPath[req._opPath.length - 1] === "/"
-                    ) {
-                        req._opPath = req._opPath.slice(0, -1);
-                    }
-                    if (req.app.parent && route.callbacks[0]?.constructor.name === "Application") {
-                        useApp(req, req.app.parent);
-                    }
+                    req._consumed -= req._stack.pop();
+                    setMountedPath(req);
+                    restoreApp(route, req);
                 }
                 if (thingamabob === "router") {
                     if (this.skipCheck) {
                         // on a compiled chain, leaving the router is what running out of chain
-                        // already means: ordinary routing takes over after the mount
-                        return this.dispatch(this.routes.length);
+                        // already means: ordinary routing takes over after the mount. With no
+                        // mount in the chain the router being left is the app's own, and nothing
+                        // of it may run afterwards, not even a middleware registered later
+                        if (this.skipUntil?.keepMount) {
+                            return this.dispatch(this.routes.length);
+                        }
+                        return this.resolve(false);
                     }
                     // out of this router entirely, so whoever mounted it carries on after the
                     // mount. The app's own walk has nobody after it, and answers 404
@@ -356,6 +427,7 @@ class Walk {
             } else {
                 req._error = thingamabob;
                 req._errorKey = route.routeKey;
+                req._errorGroup = route.group;
             }
         }
         const kind = route.callbackKinds[this.callbackIndex];
@@ -371,6 +443,7 @@ class Walk {
         }
         if (kind === CALLBACK_ROUTER) {
             if (callback.constructor.name === "Application") {
+                rememberApp(this, route, req);
                 useApp(req, callback);
             }
             const pushedParams = callback.settings.mergeParams;
@@ -380,12 +453,12 @@ class Walk {
             // express restores req.params when a router hands back, so what runs after the mount
             // sees the params it had before it
             const parentParams = req.params;
-            if (
-                callback.settings["strict routing"] &&
-                req.endsWithSlash &&
-                req._opPath[req._opPath.length - 1] !== "/"
-            ) {
-                req._opPath += "/";
+            // each router answers OPTIONS with the verbs it knows itself, so the one being entered
+            // starts its own list: express keeps that list per router, and a router that hands back
+            // without answering leaves the outer one's untouched
+            const parentMethods = req._matchedMethods;
+            if (parentMethods !== null) {
+                req._matchedMethods = new Set();
             }
             callback
                 ._routeRequest(req, res, 0)
@@ -397,15 +470,25 @@ class Walk {
                     req.params = parentParams;
                     if (req._error) {
                         req._errorKey = route.routeKey;
+                        req._errorGroup = route.group;
+                    }
+                    if (routed) {
+                        if (parentMethods !== null) {
+                            req._matchedMethods = parentMethods;
+                        }
+                        return this.resolve(true);
+                    }
+                    const childMethods = req._matchedMethods;
+                    if (parentMethods !== null) {
+                        req._matchedMethods = parentMethods;
                     }
-                    if (routed) return this.resolve(true);
-                    if (req._isOptions && req._matchedMethods.size) {
+                    if (req._isOptions && childMethods.size) {
                         // OPTIONS routing is different, it stops in the router if matched.
                         // Express answers as the router hands back, so a throw while answering,
                         // a head already written being the way, walks on to later error handlers
                         if (!req._error) {
                             try {
-                                router._sendOptionsReply(req, res);
+                                router._sendOptionsReply(req, res, childMethods);
                                 return this.resolve(true);
                             } catch (err) {
                                 return this.step(err);
@@ -445,12 +528,14 @@ class Walk {
                     out.catch((err) => {
                         req._error = err || new Error("Rejected promise");
                         req._errorKey = route.routeKey;
+                        req._errorGroup = route.group;
                         return this.step(undefined);
                     });
                 }
             } catch (err) {
                 req._error = err;
                 req._errorKey = route.routeKey;
+                req._errorGroup = route.group;
                 return this.step(undefined);
             }
         }
@@ -513,22 +598,62 @@ function nativeFail(err) {
 }
 
 /**
- * What a RegExp mount consumed of the path, escaped so the mount-stack join can compile it as a
- * literal. Exec runs on the same fixed-up path _pathMatches tested: a parent mount that consumed
+ * How much of the path a mount takes, which is what its own pattern matched and never more than
+ * there is. Exec runs on the same fixed-up path _pathMatches tested: a parent mount that consumed
  * everything leaves "", where the pattern was matched against "/".
  *
- * @param {any} router
+ * Counting what each mount took, rather than rebuilding one pattern out of the whole stack and
+ * matching that against the original path, is the difference between a sum and a guess: a mount
+ * written as an optional group composes into a pattern the path no longer satisfies, and the
+ * prefix stayed on.
+ *
  * @param {any} route
  * @param {any} req
- * @returns {string}
+ * @returns {number}
  */
-function regexMountEntry(router, route, req) {
-    let mountPath = req._opPath;
-    if (req.endsWithSlash && mountPath.endsWith("/") && !router.get("strict routing")) {
-        mountPath = mountPath.slice(0, -1);
+function mountPrefixLength(route, req) {
+    const path = req._opPath;
+    if (typeof route.pattern === "string") {
+        return route.pattern.length;
     }
-    const matched = route.pattern.exec(mountPath === "" ? "/" : mountPath);
-    return matched ? escapePathLiteral(matched[0]) : "";
+    const matched = route.pattern.exec(path === "" ? "/" : path);
+    return matched ? Math.min(matched[0].length, path.length) : 0;
+}
+
+/**
+ * Writes the path the routes below a mount see: the original with what the mounts took off the
+ * front. The root reads as "/" rather than as nothing, which is how express hands it over.
+ *
+ * @param {any} req
+ */
+function setMountedPath(req) {
+    req._opPath = req._consumed === 0 ? req._originalPath : req._originalPath.slice(req._consumed);
+    req.url = req._opPath === "" ? "/" + req.urlQuery : req._opPath + req.urlQuery;
+    req.path = req._opPath === "" ? "/" : req._opPath;
+    req._lastUrl = req.url;
+}
+
+/**
+ * The route's own params merged with those of the mounts it sits under, in express's order: an
+ * outer mount first, the route's own last. Numbered captures do not overwrite each other, they
+ * shift, so a RegExp mount capturing one group leaves the route's own group numbered from one.
+ *
+ * @param {Record<string, any>} own what this route's own pattern captured
+ * @param {Record<string, any>[]} stack the mounts, outermost first
+ * @returns {Record<string, any>}
+ */
+/**
+ * Whether this route reads the parameters of the mounts above it, which is its own router asking
+ * for them. The stack holds what a mergeParams router captured on the way in, and a plain router
+ * mounted inside one must not read it: express asks each router in turn, not the outermost.
+ *
+ * @param {any} route
+ * @param {any} fallback the router dispatching, when the route names no owner
+ * @returns {boolean}
+ */
+function mergesParams(route, fallback) {
+    const owner = route.owner ?? fallback;
+    return Boolean(owner?.settings?.mergeParams);
 }
 
 /**
@@ -628,7 +753,7 @@ function adoptPlainRequest(req, router) {
     req.originalUrl = req.originalUrl ?? arrived;
     req._originalPath = path;
     req.endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
-    req._opPath = req.endsWithSlash && path !== "/" && !router.get("strict routing") ? path.slice(0, -1) : path;
+    req._opPath = path;
     req._lastUrl = req.url;
     req._isOptions = req.method === "OPTIONS";
     req._isHead = req.method === "HEAD";
@@ -636,7 +761,7 @@ function adoptPlainRequest(req, router) {
     // null, not fresh arrays: the push sites materialize them on the first mount, and most
     // requests never see one, same as the Request constructor
     req._stack = null;
-    req._stackMounted = 0;
+    req._consumed = 0;
     req._paramStack = null;
     req._matchedMethods = req._isOptions ? new Set() : null;
     req.routeCount = 1;
@@ -673,9 +798,6 @@ function onNativeAborted() {
     response.socket?.emit("error", err);
 }
 
-/**
- *
- */
 /**
  * The per-request constants of a fully literal native registration. µWS matched the URL byte for
  * byte against this exact pattern and dispatches by method, so the request constructor can take
@@ -683,15 +805,14 @@ function onNativeAborted() {
  *
  * @param {string} path the registered pattern, which is what getUrl() would have answered
  * @param {string} method uppercase, fixed by which uWS verb the registration used
- * @param {boolean} strict the owner's strict routing, frozen here like the twin registration is
  */
-function nativePreset(path, method, strict) {
+function nativePreset(path, method) {
     const endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
     return {
         path,
         method,
         endsWithSlash,
-        opPath: endsWithSlash && path !== "/" && !strict ? path.slice(0, -1) : path,
+        opPath: path,
         isOptions: method === "OPTIONS",
         isHead: method === "HEAD",
         // set at registration when the whole chain provably never reads a header, or never
@@ -752,6 +873,138 @@ const CALLBACK_ROUTER = 2;
  * @param {any} req
  * @param {any} app
  */
+/**
+ * Reports a parameter that will not decode, unless something is already being reported.
+ *
+ * Matching a route decodes its parameters, and that happens while the walk is still looking for
+ * whoever should answer, including when it is looking for an error handler. Express does the same
+ * and keeps the first error it has: `layerError = layerError || match` in its router. Overwriting
+ * meant a middleware that had already refused the path, express.static answering Bad Request on an
+ * escape it could not decode, had its answer replaced by the decode failure of a route further down
+ * that was never going to run. Same status, different message, and only when a later route happens
+ * to match the same path. Found by fuzzing route tables against express.
+ *
+ * @param {any} req
+ * @param {any} route
+ * @param {any} err
+ */
+function raiseDecodeFailure(req, route, err) {
+    if (req._error) {
+        return;
+    }
+    req._error = err;
+    req._errorKey = route.routeKey;
+    req._errorGroup = route.group;
+}
+
+// the verbs a body is read for unless the application says otherwise, which is the parsers' own
+// list. A request with any other verb reaches a parser's method check and leaves through it
+const BODY_METHODS = new Set(["POST", "PUT", "PATCH", "QUERY"]);
+
+/**
+ * Whether this layer can be stepped over for this request without changing a thing.
+ *
+ * Only the body parsers are ever asked. Their prologue leaves a request that said nothing about a
+ * body alone, whatever content type it carries, which is what `kGetSafe` already records for the
+ * header-skip analysis. Two conditions on top of that mark, and both are needed:
+ *
+ * The request must have said nothing about framing at all, a `content-length: 0` included. A parser
+ * that can see a length answers about the body it describes even when that body is empty: a zero
+ * length with a charset nobody can decode is a 415, in express and here.
+ *
+ * And the verb must be one no parser reads a body for. With no length and no transfer-encoding a
+ * POST still walks into the read, comes back with nothing, and leaves `req.body` as the empty value
+ * its parser produces, which is a thing a handler can see.
+ *
+ * What this is worth: a hop measured 367 microseconds per thousand requests on the machine this was
+ * written on, and the parser prologue it reaches measured 38. Ten to one, for a layer that had
+ * nothing to do.
+ *
+ * @param {any} route
+ * @param {any} req
+ * @returns {boolean}
+ */
+function stepsOver(route, req) {
+    if (route.bodyParserOnly !== true || req._hasBodyHeaders === true) {
+        return false;
+    }
+    if (BODY_METHODS.has(req.method)) {
+        return false;
+    }
+    // an application can add its own. Read once and kept, which is what the parser behind this
+    // layer does with the same setting: asking on every request measured 17 microseconds per
+    // thousand, a third of what stepping over the layer saves
+    if (route.bodyMethods === undefined) {
+        route.bodyMethods = req.app.get("body methods") ?? null;
+    }
+    return route.bodyMethods === null || !route.bodyMethods.includes(req.method);
+}
+
+/**
+ * Whether a route could answer a request for this path, judged on the pattern it was compiled to.
+ * A literal answers only itself; anything with a parameter or a wildcard answers what its regex
+ * says. Used where the question is "would this earlier route have had its turn first".
+ *
+ * @param {any} route
+ * @param {string} path
+ * @returns {boolean}
+ */
+function couldAnswer(route, path) {
+    if (route.pattern instanceof RegExp) {
+        return route.pattern.test(path);
+    }
+    return route.pattern === path;
+}
+
+/**
+ * Notes which application is current before a mounted one is entered, so that exact one comes back
+ * when it hands over.
+ *
+ * Only an application takes it back. Express restores req.app by putting the request prototype
+ * back, and it wraps a mounted application to do that only in Application#use: hang one off a plain
+ * Router and nothing restores it, so whatever runs afterwards still reads the settings of the
+ * application that was entered. Restoring regardless made a later res.send answer with the outer
+ * application's etag setting where express answers with the inner.
+ *
+ * And what comes back is what was current, not the entered application's parent. Those differ the
+ * moment a sub-app is entered from inside another sub-app that a plain Router mounted: the outer
+ * one is still current, express puts that one back, and reaching for `.parent` skipped a level.
+ * A 404 from the top application then carried an ETag under `app.set("etag", false)`, because the
+ * settings answering were the inner application's. Found by fuzzing three levels of routers.
+ *
+ * The route is remembered alongside, so the pop can only ever take back what this same route put
+ * there: a mounted application that answers instead of handing over leaves its entry behind, and
+ * the request is over by then.
+ *
+ * @param {any} walk
+ * @param {any} route
+ * @param {any} req
+ */
+function rememberApp(walk, route, req) {
+    if (walk.router._isApplication && route.callbacks[0]?.constructor.name === "Application") {
+        (req._appStack ??= []).push(route, req.app);
+    }
+}
+
+/**
+ * Puts back what rememberApp noted, if this is the route that noted it.
+ *
+ * @param {any} route
+ * @param {any} req
+ */
+function restoreApp(route, req) {
+    const stack = req._appStack;
+    if (stack !== undefined && stack.length > 0 && stack[stack.length - 2] === route) {
+        const app = stack.pop();
+        stack.pop();
+        useApp(req, app);
+    }
+}
+
+/**
+ * @param {any} req
+ * @param {any} app
+ */
 function useApp(req, app) {
     req.app = app;
     if (req.res) {
@@ -776,7 +1029,8 @@ function useApp(req, app) {
 const methods = ["all", ...METHODS.filter((method) => method !== "GET").map((method) => method.toLowerCase())];
 const supportedUwsMethods = new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD", "CONNECT", "TRACE"]);
 
-const regExParam = /:(\w+)/g;
+// the same name rule patternToRegex reads, so a unicode name is found here too
+const regExParam = /:([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)/gu;
 
 // Internals here are _underscore and not #private: a callable router is a function with the
 // router's properties copied onto it, and a # field cannot be copied, so #routes would throw
@@ -818,10 +1072,24 @@ function callablePrototypeFor(classPrototype) {
  * The default error page, which is the one Express produces: the stack in a pre, and nothing else.
  * What reaches it has already been redacted when the environment calls for it.
  *
+ * The text is escaped, which is not decoration. An error message can carry anything a client sent,
+ * a path or a header among them, and writing it into the page unescaped put whatever it held into
+ * the markup. The Content-Security-Policy on this response stops a script there from running, but
+ * a policy is a second line and not the first. finalhandler escapes and then puts the line breaks
+ * and the indentation back as markup, and this reads the same as what it produces.
+ *
  * @param {any} err
  * @returns {string}
  */
 function generateErrorPageHtml(err) {
+    const text = String(err?.stack ?? err)
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;")
+        .replace(/\n/g, "<br>")
+        .replace(/ {2}/g, " &nbsp;");
     return (
         `<!DOCTYPE html>\n` +
         `<html lang="en">\n` +
@@ -830,7 +1098,7 @@ function generateErrorPageHtml(err) {
         `<title>Error</title>\n` +
         `</head>\n` +
         `<body>\n` +
-        `<pre>${err?.stack ?? err}</pre>\n` +
+        `<pre>${text}</pre>\n` +
         `</body>\n` +
         `</html>\n`
     );
@@ -860,6 +1128,36 @@ module.exports = class Router extends EventEmitter {
      */
     uwsApp;
 
+    /**
+     * Whether an unset routing flag reads on through the mount parent. Only an application does,
+     * because express chains a mounted app's settings onto its parent's; a plain Router keeps
+     * whatever its options said and nothing else.
+     *
+     * @type {boolean}
+     */
+    _inheritsSettings = false;
+
+    /**
+     * Whether this is an application rather than a plain router. Read on the hop out of a mount,
+     * where only an application takes req.app back, and a field rather than a name comparison
+     * because that sits on the dispatch path.
+     *
+     * @type {boolean}
+     */
+    _isApplication = false;
+
+    /**
+     * The two routing flags once read, undefined until then. Express passes caseSensitive and
+     * strict in when it builds a router and never looks at them again, so they are frozen here at
+     * the first read rather than resolved per request.
+     *
+     * @type {boolean|undefined}
+     */
+    _strictFlag;
+
+    /** @type {boolean|undefined} */
+    _caseFlag;
+
     /**
      * @param {object} [settings] router options. caseSensitive and strict are accepted under the
      *   names Express's Router takes, and stored under the setting names the rest of the code reads
@@ -992,6 +1290,53 @@ module.exports = class Router extends EventEmitter {
         return this.createRoute("GET", path, this, ...callbacks);
     }
 
+    /**
+     * A routing flag, read once and kept. Express builds a router's matcher the first time the
+     * router is needed and hands it caseSensitive and strict there, so a mount that happens after
+     * that, or an app.set() that happens after that, cannot change how this router matches. Asking
+     * per request instead would let a strict application make every router mounted on it strict,
+     * which express does not do.
+     *
+     * @param {string} key the setting name
+     * @returns {boolean}
+     */
+    _routingFlag(key) {
+        const own = this.settings[key];
+        if (typeof own !== "undefined") {
+            return Boolean(own);
+        }
+        return this._inheritsSettings && this.parent ? Boolean(this.parent.get(key)) : false;
+    }
+
+    /**
+     * Reads both flags at once, the first time either is wanted, because express reads both at
+     * once too: it passes them together to the router it builds. Freezing them apart would let a
+     * router end up strict from the moment before a mount and case sensitive from the moment
+     * after it, which is a state express can never be in.
+     */
+    _freezeRoutingFlags() {
+        if (this._strictFlag === undefined) {
+            this._strictFlag = this._routingFlag("strict routing");
+            this._caseFlag = this._routingFlag("case sensitive routing");
+        }
+    }
+
+    /**
+     * @returns {boolean} whether this router tells /things from /things/
+     */
+    _strictRouting() {
+        this._freezeRoutingFlags();
+        return /** @type {boolean} */ (this._strictFlag);
+    }
+
+    /**
+     * @returns {boolean} whether this router tells /Things from /things
+     */
+    _caseSensitive() {
+        this._freezeRoutingFlags();
+        return /** @type {boolean} */ (this._caseFlag);
+    }
+
     /**
      * The pattern matching everything the mounts on this request have consumed so far, which is
      * what a nested router strips off the path before matching against it. Cached per stack, since
@@ -1022,7 +1367,12 @@ module.exports = class Router extends EventEmitter {
             const stackPattern = fullStack.includes(":")
                 ? fullStack.replace(/(\\?):(\w+)/g, (whole, escaped, name, at) => (escaped ? whole : ":m" + at))
                 : fullStack;
-            fullMountpath = patternToRegex(stackPattern, true, Boolean(this.get("case sensitive routing")));
+            // insensitive whatever this router says, because this only finds again a prefix that
+            // has already been accepted, by the routers that own those mounts and under their
+            // rules. A case sensitive router mounted on an insensitive app is reached as /LIST
+            // while it is registered as /list, and compiling this one its way left the prefix in
+            // place and every parameter below it unread
+            fullMountpath = patternToRegex(stackPattern, true, false);
             this._mountpathCache.set(fullStack, fullMountpath);
         }
         return fullMountpath;
@@ -1038,18 +1388,10 @@ module.exports = class Router extends EventEmitter {
      * @returns {boolean}
      */
     _pathMatches(route, req) {
+        // the path as it arrived, mount prefixes aside: whether a trailing slash is allowed is
+        // written into the pattern, where express writes it too
         let path = req._opPath;
         let pattern = route.pattern;
-
-        if (route.userRegexp) {
-            // a RegExp the application wrote is matched against the path as it arrived: express
-            // relaxes a trailing slash only for the paths it compiled itself
-            if (req.endsWithSlash && !path.endsWith("/")) {
-                path += "/";
-            }
-        } else if (req.endsWithSlash && path.endsWith("/") && !this.get("strict routing")) {
-            path = path.slice(0, -1);
-        }
         // the line above turns the root path into the empty string, which no pattern is written
         // against. A regex route was tested against it and app.get("*path") answered every request
         // but "/"
@@ -1061,11 +1403,22 @@ module.exports = class Router extends EventEmitter {
             if (pattern === "/*") {
                 return true;
             }
-            if (!this.get("case sensitive routing")) {
+            if (!this._caseSensitive()) {
                 path = path.toLowerCase();
                 pattern = pattern.toLowerCase();
             }
-            return pattern === path;
+            if (pattern === path) {
+                return true;
+            }
+            // a literal path is compared as text rather than compiled, so the trailing slash a
+            // pattern would have carried as "/?" is allowed here instead. The registered path has
+            // had its own taken off already, unless it is the root
+            return (
+                !this._strictRouting() &&
+                path.length === pattern.length + 1 &&
+                path.charCodeAt(path.length - 1) === 0x2f &&
+                path.startsWith(pattern)
+            );
         }
         if (pattern === EMPTY_REGEX) {
             return true;
@@ -1105,12 +1458,15 @@ module.exports = class Router extends EventEmitter {
             // a mount always drops it, strict routing or not: strictness is about the end of a
             // path, and a mount has none. Express registers its use layers with strict off
             if (
-                (method === "USE" || !this.get("strict routing")) &&
+                (method === "USE" || !this._strictRouting()) &&
                 typeof path === "string" &&
                 path.endsWith("/") &&
                 path !== "/"
             ) {
-                path = path.slice(0, -1);
+                // every one of them, not the last: express loosens with /\/+$/, so a route written
+                // "/test//" is registered as "/test" and answers "/test" and "/test/" but not the
+                // path it was written as
+                path = path.replace(/\/+$/, "");
             }
             if (path === "*") {
                 path = "/{*splat}";
@@ -1120,9 +1476,7 @@ module.exports = class Router extends EventEmitter {
                 path,
                 pattern:
                     method === "USE" || needsConversionToRegex(path)
-                        ? // Boolean, not the raw value: an unset setting reads undefined, which a
-                          // default parameter would silently turn back into case-sensitive
-                          patternToRegex(path, method === "USE", Boolean(this.get("case sensitive routing")))
+                        ? patternToRegex(path, method === "USE", this._caseSensitive(), this._strictRouting())
                         : path,
                 callbacks,
                 // instanceof walks a prototype chain and length is a property load, and both used
@@ -1134,12 +1488,23 @@ module.exports = class Router extends EventEmitter {
                           ? CALLBACK_ERROR
                           : CALLBACK_PLAIN
                 ),
+                // A body parser, and nothing else: they carry the mark that says their prologue
+                // leaves a request that declared no body alone. Reaching one costs a hop, and the
+                // hop measures ten times what the prologue does, so a request that provably gets
+                // nothing out of it steps over the whole layer. See stepsOver
+                bodyParserOnly: method === "USE" && callbacks.length === 1 && callbacks[0][kGetSafe] === true,
+                // the "body methods" setting as it stood the first time this layer was reached,
+                // kept the way the parser behind it keeps it. undefined until then
+                bodyMethods: undefined,
                 // a mount written as a RegExp matches a piece of path that is not known until a
                 // request comes in, so its stack entry cannot be the path itself
                 regexMount: method === "USE" && path instanceof RegExp,
                 // written by the application, so express matches it as it stands
                 userRegexp: path instanceof RegExp,
                 routeKey: routeKey++,
+                // which app.route() this came from, when it came from one, so the routes it built
+                // count as one route where an error is concerned. undefined for every other route
+                group: this._pendingGroup,
                 // the router this was registered on. Ordinary dispatch is done by that router, so
                 // it could ask itself, but an optimized chain is walked by the app whatever it
                 // contains, and param() callbacks belong to the router that declared them
@@ -1197,8 +1562,12 @@ module.exports = class Router extends EventEmitter {
         // so the text comparisons below run on the folded form. µWS itself still matches bytes:
         // a request in the registered case takes the chain, any other case takes the fallback,
         // and both answer as express would as long as the chain agrees with registration order
-        const caseSensitive = Boolean(this.get("case sensitive routing"));
+        const caseSensitive = this._caseSensitive();
         const routePathFolded = caseSensitive || typeof route.path !== "string" ? route.path : route.path.toLowerCase();
+        // whether this route answers only the path as written, or the one with a trailing slash too
+        const strictHere = (route.owner ?? this)._strictRouting();
+        /** @type {string[]|null} earlier literals a case variant could smuggle a request past */
+        let caseGuards = null;
 
         for (let i = 0; i < routes.length; i++) {
             const r = routes[i];
@@ -1212,6 +1581,18 @@ module.exports = class Router extends EventEmitter {
             if (!r.all && r.method !== route.method) {
                 // check if the methods are compatible (GET and HEAD)
                 if (!(r.method === "HEAD" && route.method === "GET")) {
+                    // A mount is registered ALL, because what lives under it can answer any
+                    // method, and this chain is computed once for all of them. So an earlier
+                    // route of some other method is not irrelevant here the way it is for a
+                    // plain route: it belongs in the chain of the leaves that share its method
+                    // and in no other, and one chain cannot say that. µWS would then jump
+                    // straight to a leaf and answer as though the earlier route did not exist,
+                    // which is what let a literal route inside a mounted router beat a parameter
+                    // route written before the mount. Leave the mount to ordinary dispatch,
+                    // where express's own order is what decides.
+                    if (route.use && typeof route.path === "string" && couldAnswer(r, route.path)) {
+                        return false;
+                    }
                     continue;
                 }
             }
@@ -1241,9 +1622,14 @@ module.exports = class Router extends EventEmitter {
             }
 
             // check if the paths match. A route with parameters is excluded from the text test:
-            // its literal ":name" text would let an earlier regex in on requests it never matches
+            // its literal ":name" text would let an earlier regex in on requests it never matches.
+            // Both spellings of this route's path are tried, because without strict routing it
+            // answers "/x/" as well as "/x", and an earlier pattern that matches only the first is
+            // still an earlier pattern that answers a request this registration would take.
             if (
-                (r.pattern instanceof RegExp && (!withParams || r.use) && r.pattern.test(route.path)) ||
+                (r.pattern instanceof RegExp &&
+                    (!withParams || r.use) &&
+                    (r.pattern.test(route.path) || (!strictHere && r.pattern.test(route.path + "/")))) ||
                 (typeof r.pattern === "string" &&
                     (r.pattern === route.path ||
                         (!caseSensitive && r.pattern.toLowerCase() === routePathFolded) ||
@@ -1281,18 +1667,26 @@ module.exports = class Router extends EventEmitter {
                 continue;
             }
             // otherwise the two overlap only where µWS itself hands the request to the earlier,
-            // more specific registration, so this chain never sees those paths. That argument is
-            // about bytes, so under insensitive routing it only holds when no literal hides
-            // behind a case difference
+            // more specific registration, so this chain never sees those paths
             if (
                 !r.optimizedPath ||
                 !uwsPrefersEarlier(r.path, route.path) ||
-                (!caseSensitive && (r.path !== rPathFolded || route.path !== routePathFolded))
+                (!caseSensitive && route.path !== routePathFolded)
             ) {
                 return false;
             }
+            // that argument is about bytes. Under insensitive routing "/POSTS" byte-matches no
+            // registration of "/posts", so µWS hands it here instead, where this chain would
+            // answer as if the earlier route did not exist. The literal is remembered so the
+            // registration can send those requests to the generic router, which is the only place
+            // express's own order can decide; a path with no letter in it has no other case to
+            // arrive in and needs no guard
+            if (!caseSensitive && HAS_LETTER.test(r.path)) {
+                (caseGuards ??= []).push(r.path);
+            }
         }
         optimizedPath.push(route);
+        route._caseGuards = caseGuards;
 
         return optimizedPath;
     }
@@ -1324,8 +1718,10 @@ module.exports = class Router extends EventEmitter {
                     ) {
                         let pathToMount = router._optimizeRoute(route, router._routes);
                         if (!pathToMount) {
+                            route._whyGeneric = "something before it in the same router overlaps its paths";
                             continue;
                         }
+                        route._walkedInto = true;
                         pathToMount = pathToMount.slice(0, -1);
                         walk(route.callbacks[0], pathPrefix + route.path, [
                             ...chainPrefix,
@@ -1342,6 +1738,13 @@ module.exports = class Router extends EventEmitter {
                                         : undefined
                             }
                         ]);
+                    } else {
+                        // said once here rather than at each condition above: a mount is walked into
+                        // only when µWS can match its path on its own and it carries exactly one
+                        // router, and those are the two things worth telling anyone about
+                        route._whyGeneric = !(route.callbacks.length === 1 && route.callbacks[0] instanceof Router)
+                            ? "it is middleware rather than a single mounted router"
+                            : "µWS cannot match this mount path on its own";
                     }
                     // µWS picks by specificity and Express by registration order, so the chain
                     // computed for whichever route µWS lands on runs everything that could have
@@ -1356,6 +1759,7 @@ module.exports = class Router extends EventEmitter {
                 ) {
                     const leafPath = router._optimizeRoute(route, router._routes);
                     if (!leafPath) {
+                        route._whyGeneric = "something before it in the same router overlaps its paths";
                         continue;
                     }
                     // param route earlier in the same router would steal this static path
@@ -1368,6 +1772,7 @@ module.exports = class Router extends EventEmitter {
                             shadow.path !== route.path &&
                             shadow.pattern instanceof RegExp
                         ) {
+                            route._whyGeneric = `the parameter route ${shadow.path} is written before it`;
                             continue;
                         }
                     }
@@ -1382,6 +1787,11 @@ module.exports = class Router extends EventEmitter {
                             pattern: pathPrefix + route.path,
                             optimizedRouter: true
                         };
+                        if (route._caseGuards) {
+                            // compared against the whole path µWS matched, so they carry the mount
+                            // prefix, folded along with the rest of it
+                            registered._caseGuards = route._caseGuards.map((p) => pathPrefix + p);
+                        }
                         this._registerUwsRoute(registered, chain);
                         // the chain holds the original object, so the request-time guard has to
                         // find the computed fields there, or a mounted param route extracts its
@@ -1389,9 +1799,19 @@ module.exports = class Router extends EventEmitter {
                         // adds no parameter of its own
                         route.optimizedParams = registered.optimizedParams;
                         route.optimizedPath = registered.optimizedPath;
+                        // and what was decided about it, for the same reason: the copy is thrown
+                        // away and the profile reads the route the application actually holds
+                        route._native = registered._native;
                     } else {
                         this._registerUwsRoute(route, chain);
                     }
+                } else if (!supportedUwsMethods.has(route.method)) {
+                    route._whyGeneric = `µWS does not serve ${route.method}`;
+                } else if (canBeOptimizedWithParams(route.path)) {
+                    // eligible but for the overlap test, which only applies inside a mount
+                    route._whyGeneric = "a route after it in the same mounted router could answer the same paths";
+                } else {
+                    route._whyGeneric = "µWS cannot match this path on its own";
                 }
             }
         };
@@ -1445,7 +1865,7 @@ module.exports = class Router extends EventEmitter {
      */
     _isFollowedByAnOverlap(route, routes) {
         // folded under insensitive routing, where a case variant answers the same requests
-        const caseSensitive = Boolean(this.get("case sensitive routing"));
+        const caseSensitive = this._caseSensitive();
         const routePath = caseSensitive ? route.path : route.path.toLowerCase();
         for (let i = routes.length - 1; i >= 0; i--) {
             const later = routes[i];
@@ -1487,6 +1907,14 @@ module.exports = class Router extends EventEmitter {
         if (route.path.includes(":")) {
             route.optimizedParams = route.path.match(regExParam).map((p) => p.slice(1));
         }
+        // null for almost every route: only a parameter route with an earlier literal that a case
+        // variant could slip past carries one, see _optimizeRoute. Built once here, and matched
+        // insensitively, since that is the folding the guard exists for
+        const caseGuards = route._caseGuards
+            ? route._caseGuards.map((p) =>
+                  needsConversionToRegex(p) ? patternToRegex(p, false, false) : p.toLowerCase()
+              )
+            : null;
         const makeHandler = (chain, preset, skips) => {
             // the mutable object a granted skip lives on, so a middleware arriving after
             // listen can take it back: a literal registration's preset doubles as it, and a
@@ -1508,6 +1936,13 @@ module.exports = class Router extends EventEmitter {
             // and this one never did. nativeDone and nativeFail defer their epilogues to a
             // microtask, which is where the await used to resume, so the visible order holds
             return (res, req) => {
+                // a request that is an earlier literal in another case: express answers it with
+                // that route, and the chain here does not contain it, so the generic router takes
+                // this one
+                if (caseGuards !== null && anyGuardHits(caseGuards, req.getUrl())) {
+                    // an application is what registers native routes, and only it serves
+                    return /** @type {any} */ (this)._serveGeneric(res, req);
+                }
                 const request = this.handleRequest(res, req, preset, skipHolder);
                 const response = request.res;
                 if (optimizedParams) {
@@ -1548,7 +1983,7 @@ module.exports = class Router extends EventEmitter {
         // the route's own router decides, not the app running the registration: a router created
         // with { strict: true } and mounted on an app without it does not answer /things/, and
         // registering that path here is the only way it could
-        const strictHere = Boolean((route.owner ?? this).get("strict routing"));
+        const strictHere = (route.owner ?? this)._strictRouting();
 
         // Whether requests served by this registration may skip the header copy: GET and its
         // HEAD twins only, the app must not compute etags (send would consult freshness
@@ -1574,7 +2009,7 @@ module.exports = class Router extends EventEmitter {
         }
         // remembered so a middleware or setting arriving after listen can take the skips back
         const makePreset = (path, method, skips) => {
-            const preset = nativePreset(path, method, strictHere);
+            const preset = nativePreset(path, method);
             if (skips.skipHeaders || skips.skipQuery) {
                 preset.skipHeaders = skips.skipHeaders;
                 preset.skipQuery = skips.skipQuery;
@@ -1601,6 +2036,9 @@ module.exports = class Router extends EventEmitter {
             route.callbacks.length === 1 && // must not have multiple callbacks
             typeof route.callbacks[0] === "function" && // must be a function
             route.paramCallbacks.size === 0 && // a param callback has to run, and this answers without running anything
+            // a declarative response is answered by µWS itself, so no javascript runs and the case
+            // guard could not: a route that needs one has to stay an ordinary handler
+            caseGuards === null &&
             !resDecMethods.some((method) => resCodes[method] !== responseProto[method].toString()) && // must not have injected methods
             this.get("declarative responses") // must have declarative responses enabled
         ) {
@@ -1612,6 +2050,18 @@ module.exports = class Router extends EventEmitter {
             replacedPath = route.path.replace(regExParam, ":x");
         }
 
+        // what listen() settled about this route, kept so `npx fulmine profile` can print it rather
+        // than making anyone read the source or instrument it. Written once, during compilation,
+        // so no request pays for it
+        route._native = {
+            path: replacedPath,
+            declarative: fn !== jsFn,
+            skipHeaders: getSkips.skipHeaders === true,
+            skipQuery: getSkips.skipQuery === true,
+            ahead: optimizedPath.length - 1,
+            guards: caseGuards ? caseGuards.length : 0
+        };
+
         this.uwsApp[method](replacedPath, fn);
         if (!strictHere && route.path[route.path.length - 1] !== "/") {
             // a declarative response answers the twin as itself; a preset handler cannot be
@@ -1739,10 +2189,10 @@ module.exports = class Router extends EventEmitter {
         // asking for each name in turn rather than walking the groups object, which is a
         // null-prototype dictionary and slow to enumerate, and reading the wildcard answer that was
         // worked out when the pattern was compiled instead of searching an array for it
-        const { paramNames, isWildcard } = meta;
+        const { paramNames, outputNames, isWildcard } = meta;
         for (let i = 0, len = paramNames.length; i < len; i++) {
-            const name = paramNames[i];
-            const value = groups[name];
+            const name = outputNames[i];
+            const value = groups[paramNames[i]];
             // an optional group that did not match is absent in v5, not present as undefined
             if (value === undefined) {
                 continue;
@@ -1776,36 +2226,29 @@ module.exports = class Router extends EventEmitter {
                     req.params[name] = decodeParam(req.optimizedParams[name]);
                 }
             } catch (err) {
-                req._error = err;
-                req._errorKey = route.routeKey;
+                raiseDecodeFailure(req, route, err);
                 return "route";
             }
         } else if (route.complex) {
-            let path = req._originalPath;
-            if (req._stack !== null && req._stack.length > 0) {
-                const fullMountpath = this.getFullMountpath(req);
-                if (fullMountpath !== EMPTY_REGEX) {
-                    path = path.replace(fullMountpath, "");
-                }
-            }
+            // the path with the mounts taken off, which is what _opPath is
+            const path = req._opPath;
             try {
                 req.params = this._extractParams(route.pattern, path);
             } catch (err) {
                 // a parameter that will not decode. Express throws out of the match and lets the
                 // error reach the error handler, which answers 400, so the route is skipped rather
                 // than run with a value nobody can read.
-                req._error = err;
-                req._errorKey = route.routeKey;
+                raiseDecodeFailure(req, route, err);
                 return "route";
             }
-            if (req._paramStack !== null && req._paramStack.length > 0) {
+            if (mergesParams(route, this) && req._paramStack !== null && req._paramStack.length > 0) {
                 req.params = mergeParams(req.params, req._paramStack);
             }
         } else {
             // express 5 gives every matched route null-prototype params; only a pathless
             // middleware layer keeps the plain object, as its router hands one to fast_slash
             req.params = route.use && route.path === "" ? {} : Object.create(null);
-            if (req._paramStack !== null && req._paramStack.length > 0) {
+            if (mergesParams(route, this) && req._paramStack !== null && req._paramStack.length > 0) {
                 req.params = mergeParams(req.params, req._paramStack);
             }
         }
@@ -1819,6 +2262,27 @@ module.exports = class Router extends EventEmitter {
         return true;
     }
 
+    /**
+     * Whether this route's parameters carry a percent escape that will not decode. Asked only of a
+     * route whose path matched and whose method did not, which express still decodes: the 400 it
+     * answers there is what this reproduces.
+     *
+     * @param {any} route
+     * @param {any} req
+     * @returns {boolean}
+     */
+    _paramsFailToDecode(route, req) {
+        if (!route.complex) {
+            return false;
+        }
+        try {
+            this._extractParams(route.pattern, req._opPath);
+            return false;
+        } catch {
+            return true;
+        }
+    }
+
     /**
      * Runs the app.param() callbacks for the parameters this route matched, and says whether the
      * route may run.
@@ -1864,6 +2328,7 @@ module.exports = class Router extends EventEmitter {
                     if (err !== "route") {
                         req._error = err;
                         req._errorKey = route.routeKey;
+                        req._errorGroup = route.group;
                     }
                     // the route is skipped either way: an error carries on to the error handlers
                     return resolve("route");
@@ -2037,15 +2502,22 @@ module.exports = class Router extends EventEmitter {
      * @returns {object} an object with one method per HTTP verb, each returning it again
      */
     route(path) {
+        // everything hung off one app.route() shares this, which is what makes them one route as
+        // far as an error is concerned, see errorHop
+        const group = ++routeGroups;
         const fns = new NullObject();
-        for (const method of methods) {
-            fns[method] = (...callbacks) => {
+        const inGroup = (method, callbacks) => {
+            this._pendingGroup = group;
+            try {
                 return this.createRoute(method, path, /** @type {any} */ (fns), ...callbacks);
-            };
-        }
-        fns.get = (...callbacks) => {
-            return this.createRoute("GET", path, /** @type {any} */ (fns), ...callbacks);
+            } finally {
+                this._pendingGroup = undefined;
+            }
         };
+        for (const method of methods) {
+            fns[method] = (...callbacks) => inGroup(method, callbacks);
+        }
+        fns.get = (...callbacks) => inGroup("GET", callbacks);
         return fns;
     }
 
@@ -2074,14 +2546,15 @@ module.exports = class Router extends EventEmitter {
      *
      * @param {any} request
      * @param {any} response
+     * @param {Set<string>} methods the verbs the answering router knows, which are its own
      */
-    _sendOptionsReply(request, response) {
+    _sendOptionsReply(request, response, methods) {
         if (response._headWritten) {
             throw new Error("Cannot set headers after they are sent to the client");
         }
         // Express 5 sorts the methods and joins them with ", ", so the header reads the same
         // regardless of the order the routes happened to be registered in
-        const allowedMethods = Array.from(request._matchedMethods).sort().join(", ");
+        const allowedMethods = Array.from(methods).sort().join(", ");
         response.setHeader("Allow", allowedMethods);
         // the router package answers this one itself, with a plain-text body, the nosniff
         // header and end() rather than send(), so no ETag comes with it
@@ -2104,7 +2577,7 @@ module.exports = class Router extends EventEmitter {
         }
         if (request._isOptions && request._matchedMethods.size > 0) {
             try {
-                this._sendOptionsReply(request, response);
+                this._sendOptionsReply(request, response, request._matchedMethods);
             } catch (err) {
                 // a head already written: the error answers instead, as express's does
                 this._handleError(err, null, request, response);