Router:
- Compression merges now record the shared entries per superseded
  registration instead of aliasing the whole registration ID, so a scope's
  helpers reach exactly the entries it registered: no more skipping an
  unmerged entry or documenting a method another scope added. Removed
  entries are forgotten again.
- Concurrent multi-method registrations no longer leave a partial batch;
  only the newest registration owns it.
- Automatic HEAD twins carry no registration ID, so a stack scan cannot
  document them, and Name() propagates to a GET route's existing twin again.
- App.Name fires OnName only when a route was actually named, not for a
  mount placeholder.
- app.Group(prefix, mw) and domainRouter.Group keep the middleware
  registration on the new scope, matching Group.Group.
- RemoveRouteFunc evaluates the matcher without the router lock, and a
  mounted app's startup twin hooks fire after the parent unlocks, so both may
  call GetRoute/GetRoutes without deadlocking.
- Redirect().Route and GetRouteURL use a routing-only lookup instead of a
  full documentation deep copy per request.
- Nested empty maps in documentation are kept as {} instead of null, and a
  batch's routes each get their own response Example copy.

OpenAPI middleware:
- A self-referential pointer field type no longer hangs SchemaOf.
- Constraint parsing mirrors path.go: the span closes at the first unescaped
  '>', a regex argument is kept whole (commas included) and other arguments
  are unescaped.
- A trailing slash no longer defeats prefix resolution under a dynamic mount.
- "*" is documented like an optional parameter, since the router also serves
  the path without it.
- AddParameter with only a description keeps the constraint-derived schema.
- Configuration deep copies are depth-bounded against cyclic values.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

- Drop the doc comments added alongside new struct fields (App.latestBatch,
  mergedEntries, latestBatchID, routesRevision, registrationID; Route.domain
  and regID; the per-router lastRegID; the internal openapi structs), matching
  the terse style of the fields already there.
- Remove the comments from the test files this branch adds, keeping only
  //nolint directives.
- Condense the remaining prose: the Router and Register interfaces carry one
  group header instead of a comment per documentation method, and the long
  explanations in app.go, router.go, mount.go, schema.go and constraint.go
  are cut to what the reader cannot get from the code.

Config field comments keep the "Optional. Default:" form the other middleware
packages use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

main now requires Go 1.26, which turns on modernize's newexpr check and made
the lint job fail on openapiBoolPtr. Drop the helper for the built-in, the same
substitution be8f165 made for the client package's ptrInt and ptrString.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

main's #4652 landed a per-registration Route.id and an auto-HEAD scan skip that
overlap with this branch's own bookkeeping, so the two had to be reconciled
rather than taken side by side:

- Route.regID is gone. main's id is the same notion — one value per register()
  call, shared by that call's per-method entries — so the scoped helpers key off
  it and the hot struct keeps a single counter. App.registrationID gives way to
  main's process-wide routeIDs, which also removes the cross-app collision the
  clone in processSubAppsRoutes used to clear its id to avoid.
- Auto-HEAD twins keep the id they copy from their GET route, because
  routeIndexInTree finds a route in another method's tree by it. Documentation
  is kept off them by their autoHead flag instead, which is what the stack scan
  in applyToRegIDLocked now skips.
- Twin OnRoute hooks still fire unlocked, so a sub-app hook may call back into
  the parent. To keep main's guarantee that an aborted pass is retried,
  fireOnRouteHooks clears the scan markers unless every hook returned, and
  RebuildTree fires the twins it used to discard.
- App.Name keeps this branch's registration-scoped form, which already covers
  the id match main added and still names the GET route's HEAD twin.
- copyRoute keeps the single-struct-copy form: it preserves every field main
  lists, id included, and additionally clones the documentation containers.
- buildTree returns nothing now that RebuildTree no longer forwards its result.

Verified on the merged tree: build, vet, golangci-lint (0 issues), go test ./...,
and -race on the core and openapi packages. openapi coverage unchanged at 97.3%.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

Registration bookkeeping keeps one index instead of three mechanisms. A
registration's live entries are recorded under its id (a compression-merged
entry under both ids), so the batch fast path, the stack scan with its autoHead
and mount exclusions, the mergedEntries side map and the id restamp on merge
all go. Entries keep the id main assigned them, which is what routeIndexInTree
finds them by. A registration that lists a method twice is indexed once, where
it used to apply an appending helper twice.

App is now the same kind of scope as Group and Registering: Name and every doc
helper go through the registration path, so latestRoute, its sentinel in New,
the reset in deleteRoute and applyToLatestRouteLocked are gone, and the OnName
hook protocol lives in one place.

domainRegistering is folded into Registering, which takes an optional handler
wrapper and host pattern; that removes 217 lines that mirrored register.go. The
scoped Parameter/RequestBody/Response forms delegate to their full forms as App
does, and docResponseHeader/docResponseLink share one factory.

The doc factories no longer deep-copy in both the factory and the per-route
closure; the closure's copy is the only one. GetRoutes sizes its result and
fills each slot in place. copyRouteBase blanks the documentation scalars, so
the auto-HEAD twin no longer does it by hand. fireOnRouteHooks drops the
scan-marker reset: twins are in the stack and the scan recorded before any
hook runs, so a panicking hook could only force a no-op rescan.

The middleware resolves the app's case rule once per app rather than copying
the 624-byte Config on every request, builds the spec from GetRoutes(true)
since middleware routes are skipped anyway, references the private route
snapshot instead of cloning it a second time, appends path parameters in place
and forks only for optional ones, and loses a dead predicate, two no-op
fallbacks, a dead branch and a duplicate pointer-deref loop. domainMatcher
carries its joined pattern instead of re-joining it per registration.

Two tests pin the new behaviour: one handler shared by two apps with different
CaseSensitive settings, and a duplicate-method registration indexed once.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

Covers the empty-content early return in sanitizeContentMediaTypes and the
blank-name panic in docResponseHeader.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

main's #4663 fixed route naming with a Route.latestID that a merged route
adopts from the merging registration. This branch already reaches the same
routes through the regEntries registration index, which covers merges by
indexing the shared entry under both ids, so latestID is dropped and
App.Name keeps the nameRegistrationLocked path. The group hand-off that
came with it stays: a merged entry takes the group of the registration
that merged into it, so Name prefixes with the group it was written
through. All four naming tests main added pass unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

- RemoveRoute and RemoveRouteByName match under the lock again: their
  matchers only compare a field, so the per-route documentation deep copy
  deleteRoute made for every candidate was wasted work held under
  app.mutex. Only RemoveRouteFunc, whose matcher is user code, goes through
  the snapshot path, which now fills each slot in place. The removal loop
  is shared by both.
- The automatic HEAD twin for a key is found in one place,
  autoHeadTwinLocked, used by both pruning and Name propagation. It drops
  the re-normalization of an already canonical path, which could miss a
  twin whose stored path ends in an escaped slash, and rejects on the
  string fields before the owner lookup.
- sanitizeContentMediaTypes validates once and rebuilds the map only when
  a key actually changed.
- The header schema comment no longer claims parity with the parameter
  rule, which merges a default type into a supplied schema; headers store a
  supplied schema as given.
- RemoveRouteFunc documents that its matcher sees a copy, in code and in
  docs/api/app.md.
- Tests: the domain-scoped prune test builds twins through RebuildTree
  rather than a request, header assertions compare whole maps, and the
  Swagger UI opt-in check joins the existing options test.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

main's #4666 dropped the strconv import from app.go once its last use
became utils.FormatInt. The merge is textually clean but no longer
compiled: responseKey and defaultResponseDescription, added on this
branch, still called strconv.Itoa. Both now use utils.FormatInt, the
helper main adopted, which formats every int the same way.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

A route that says nothing about itself now still produces a useful
operation, filled from what the router already knows. Anything set
explicitly always wins, and each inference can be switched off.

- The summary comes from the final handler's function name: listUsers
  documents as "List users" and a method value such as
  (*Server).GetUserByID as "Get user by ID". Closures and compiler
  wrappers carry no usable name, so those keep the "METHOD /path"
  fallback. Config.DisableHandlerSummaries turns this off.
- Tags come from the enclosing group. A named group contributes the last
  segment of its name; otherwise the last static segment of its prefix
  does, skipping parameters and version markers such as v1, so routes
  under Group("/api/v1/users") are tagged "users". Nested groups use the
  innermost one. Config.DisableGroupTags turns this off.
- A response that declares no media type documents Config.DefaultProduces,
  application/json unless configured. Produces and the Response* media
  types override it per route, and a status that carries no body (1xx,
  204, 205, 304) never gets one. No request body is invented, since that
  would claim the handler reads one.

Route gains GroupPrefix() and GroupName(), captured under app.mutex at
registration and again when a later registration merges into an entry and
takes its group, so a GetRoutes copy still carries them after group is
cleared.

The three test structs in schema_test.go whose field order is deliberate
are now also marked betteralign:ignore, so make betteralign passes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

A route can now be documented with the Go types its handler already binds,
the way FastAPI reads a signature, instead of hand-written schema maps.

- Accepts(model, mediaTypes...) documents the request body as the schema
  of a Go value, Returns(status, model, mediaTypes...) a response, and
  Params(in, model) the parameters of one location, one per exported
  field, named by the query, header, cookie or uri tag Bind reads or by
  the field name. Path fields are required; the others follow a
  validate:"required" tag. An explicit AddParameter for the same name
  still wins. All four router types and both interfaces gain the three.
- Every helper that takes a schema now takes any: a map is used as it
  was, and a Go value is reflected when the document is generated, so
  the schema fields of RouteParameter, RouteMediaType, RouteResponse and
  RouteRequestBody are any. A model is stored as is, since only its type
  is read; a map is still deep-copied per route.
- Named struct types are emitted once under components.schemas and
  referenced with $ref wherever they appear, nested types included, so
  a self-referential type resolves to its own reference instead of a
  bare object. Names already present in Config.Components are left to
  the user; a colliding type is qualified by package, then numbered, and
  generic instantiations are reduced to the characters a component key
  allows. SchemaOf keeps inlining, as documented.
- validate tags become constraints: required outranks omitempty, min,
  max, len, gte and lte become the limit keyword of the field's type,
  oneof becomes enum, and the email, uuid, url, uri, ipv4, ipv6,
  hostname, base64 and RFC 3339 datetime rules set format unless the
  openapi tag already did.
- Config.DefaultConsumes documents the request media type for a body
  declared without one, so RequestBody and Accepts no longer require a
  media type and the guard that panicked without one is gone.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG

…sponses

The middleware on a request's path now describes itself in the generated
document, and a route's models describe themselves more fully.

- A route's handlers and the Use routes registered ahead of it whose
  prefix covers its path are recognized by the source file their handler
  was compiled from, which is what survives an inlined New and a forked
  module path. keyauth and contrib/jwt add a bearerAuth requirement and
  scheme (bearerFormat JWT when only the JWT middleware uses it),
  basicauth a basicAuth one, and a chained pair a single requirement
  naming both; each adds a 401 carrying WWW-Authenticate. csrf adds a
  required X-Csrf-Token header parameter and a 403 on the methods it
  protects. requestid, limiter, etag and cache add the headers they set
  and the 429 and 304 they send. An explicit Security() and a scheme the
  user declares under the same name always win, and headers or responses
  a route documents itself are kept. Config.DisableMiddlewareInference
  turns it off.
- With a StructValidator configured, a route that declares a body or
  parameters gets a 400 response, since binding can reject the request.
  Config.DisableValidationResponses turns it off.
- Error responses use Config.ErrorProduces, text/plain by default to match
  the app's error handler, and Config.ErrorSchema, a schema or a Go value.
- openapi:"readOnly", "writeOnly" and "deprecated" set the flag of the
  same name on a property, and a struct whose fields carry examples gets
  an object-level example assembled from them, following references to
  registered types for theirs.
- Route.Domain exposes the host a route was registered under, which the
  coverage check reads.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XHncVMdy1VPWCTp53PQoYG