The root context path is "", not "/". getContextPath() and ServletContext.getContextPath() return the empty string for an application mounted at the root (section 3.5); contextPath("/") is still accepted as its alias.

Context paths are validated at deploy. A context path must be empty or start with /, must not end with /, and must not contain an empty, . or .. segment, a control character, a backslash, %, ;, ? or #; an invalid one fails the deployment with an IllegalArgumentException.

Default session tracking modes are {COOKIE, URL}. encodeURL and encodeRedirectURL now append ;jsessionid=<id> when a session exists and the client did not send its id in a cookie. Restrict the modes with <tracking-mode> or SessionCookieConfig/setSessionTrackingModes if you do not want URL rewriting.

The session store is consulted on every request carrying a session id (cookie or ;jsessionid), even when the application never calls getSession, so that the session’s last-accessed time moves (section 7.6). A custom SessionStore sees a lookup per such request.

A container default servlet (foy.default) is installed when no application servlet maps /. It serves the static resources of the resource provider; with the default ClassPathResourceProvider that is the META-INF/resources/ tree of every root of the class loader (application roots, fragment jars, then any other jar), over HTTP. To opt out, map a servlet of your own to /, or pass a resourceProvider(…​) that does not expose those roots.

Non-canonical request paths are answered 400. A path that holds a raw backslash or control character, a malformed or encoded separator or NUL escape, a dot-only segment once decoded, or climbs above the context root with .. is refused before any filter or servlet runs (section 3.5.2); a path outside the context path is answered 404.

WEB-INF/ and META-INF/ are refused to every client request (404), whichever servlet the path maps to (a *.jsp mapping included), in any case and with trailing dots or spaces; /WEB-INF without a slash is a 404, not a redirect. A welcome file under these trees is never resolved. Forward, include, error and async dispatches may still target them.

Dispatch paths are context-relative. ServletContext.getRequestDispatcher, ServletRequest.getRequestDispatcher and AsyncContext.dispatch(String) no longer strip a leading copy of the context path: in context /app, getRequestDispatcher("/app/x") targets /app/x inside the application.

Header values are validated. setHeader, addHeader (and the int/date variants), setContentType, setCharacterEncoding and addCookie throw IllegalArgumentException for a name or value containing CR, LF, NUL or a character above U+00FF. sendRedirect percent-encodes (UTF-8) non-ASCII characters, spaces and controls of the location, so a Location header never carries a line break.

An unhandled exception answers a generic 500 body (Internal Server Error); the exception and its message are logged, never echoed to the client.

Servlet code runs on a Foy virtual thread, not on Chappe’s connection thread. Filters, servlets and listeners run on foy-request-<n>. Chappe’s RequestContext.CURRENT is re-bound there, but any other ThreadLocal or ScopedValue that a Chappe filter or handler set on the connection thread is not visible to servlet code: pass such state through request attributes instead.

Responses above the buffer size are streamed. A response larger than getBufferSize() (8192 bytes by default) is committed at the overflowing write and sent while the servlet writes; without a declared Content-Length it is chunked on HTTP/1.1 (before, the whole body was held until the servlet returned and sent with a Content-Length). flushBuffer() now sends the head and the buffered bytes at once. Set a Content-Length, or a larger setBufferSize, to keep a fixed-length body.

An async timeout answers 500 through the error-page mechanism instead of a bare 503. When no AsyncListener completes or dispatches in onTimeout, the container raises an error dispatch with status 500; an <error-page> for 500 now renders it.

newPushBuilder() returns null. Code that pushed resources must check for null (the specification allows it); 103 Early Hints are the replacement.

A connection whose upload the application stopped reading is closed after the response. When a ReadListener still waits for upload bytes at the end of the request, the response is delivered and the connection is then closed rather than kept alive.

An exception after the commit aborts the response. Once the response is streaming, a late exception can no longer turn into an error page: it is logged and the body is aborted (connection aborted on HTTP/1.x, stream reset with RST_STREAM INTERNAL_ERROR on HTTP/2), so the client sees a truncated body.

Every requestDestroyed runs, even when one throws. The listeners are still called in reverse registration order; the first RuntimeException is rethrown once they have all run, with the later ones added as suppressed exceptions (an Error still propagates at once).

A failed requestInitialized is unwound. When a listener throws from requestInitialized, the listeners already initialized get requestDestroyed, in reverse order, before the exception propagates.

A filter failure on a path no servlet maps ends like any other failure. A RuntimeException or IOException thrown by a filter there (before, only a ServletException) is answered with Foy’s generic 500 and the request listeners get requestDestroyed.