So what KodeCharlie says is correct (regarding b)).
I would reword it like: We have arbitrary user input which has nothing to do what RFCs say. And this is the hard part as we have to 'guess' what the user meant.
Once the input is 'normalized' (unescaped, charset translated (into utf-8), protcoll extended, ...), the rest is straight forward following the RFCs.

@PetrPisar Regarding the filename: it is also user input. And the problem is that the wget author(s) made some decisions in the past on how to treat user input. There is no black and white here and any decision has it's pros and cons.
I think that part of the problem is that URLs on web sites are often printed in their escaped form. And wget users explicitly wanted to use copy&paste (from web site to console).

Then the next aspect is: we don't want to change a long-standing (default) behavior. This breaks (production) scripts and command lines. What we can possibly do is to add a new '--strict-input' option that skips 'guessing' and instead assumes a 100% valid URL. BTW, this is a good idea for wget2 ;-)

I agree that "wget [option]... [URL]..." is not 100% correct in terms of RFCs. But wget is also a user tool, and normal users don't have the RFCs in mind when they think about URLs.

You cannot state a question like that because a random string is ambiguous by it's nature.

According to the specification <https://datatracker.ietf.org/doc/html/rfc3986#section-2.4> there is nothing as an unescaped URI. URI is always escaped by the definition.

Look at the original report: You have a file name "qtwebengine-everywhere-src-5.15.2-%231904652.patch.gz". It's a file name. Not an URI. If you construct a URL for the file name using an "https://mirrors.slackware.com/slackware/slackware64-current/source/l/qt5/patches/" base URL, then you need to escape the file name string and then append it it after a path delimiter of the base URL. I.e. you convert the file name to "qtwebengine-everywhere-src-5.15.2-%25231904652.patch.gz" and then append it to the base resulting into "https://mirrors.slackware.com/slackware/slackware64-current/source/l/qt5/patches/qtwebengine-everywhere-src-5.15.2-%25231904652.patch.gz" URL. This URL is passed to to wget command. Thus wget should not escape it again. It could validate and report an error. But not escape it.

I will quote the specification here:

   Under normal circumstances, the only time when octets within a URI
   are percent-encoded is during the process of producing the URI from
   its component parts.  This is when an implementation determines which
   of the reserved characters are to be used as subcomponent delimiters
   and which can be safely used as data.  Once produced, a URI is always
   in its percent-encoded form.

Please, pay attention to the last sentence.

Of course wget could state that its argument is a byte stream without any other constrains. But a manual of wget(1) reads something different, it states it's a URL:

SYNOPSIS
       wget [option]... [URL]...

Hence wget should not attempt any escaping.

Here's one proposed change (see patch below).  It likely is not comprehensive enough. 

The broader issue seems to be that there are circumstances in ./src/retr.c when retrieve_url() calls url_parse(), which already was called in ./src/main.c.  This can result in the file property in struct url being modified in-place more than once (triggering errors as the one originally reported in this issue).

For now, I'm going to defer making these changes (including suggested patch below) to those more familiar with the wget repo than I.

diff --git a/src/http.c b/src/http.c
index d25762fa..a9fa237f 100644
--- a/src/http.c
+++ b/src/http.c
@@ -4280,8 +4280,10 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
     }
   else if (!opt.content_disposition)
     {
-      hstat.local_file =
-        url_file_name (opt.trustservernames ? u : original_url, NULL);
+      if (opt.trustservernames)
+        hstat.local_file = url_file_name (u, NULL);
+      else
+        hstat.local_file = original_url->file;
       got_name = true;
     }

Correction: based on debug-logs, quoted logic does seem ok. I am looking into other logic before convert_fname() (which calls iconv()) is called.

comment #1:

> system: macOS Big Sur v. 11.2.3
> wget: master branch
>
> Offending logic from ./src/url.c is shown below. I believe the issue is in iconv().
>

>       if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
>           && iconv (cd, NULL, NULL, &s, &outlen) == 0)
>         {
>           *(converted_fname + len - outlen - done) = '\0';
>           iconv_close (cd);
>           DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
>                    orig_fname, from_encoding, converted_fname, to_encoding));
>           xfree (orig_fname);
>           return converted_fname;
>         }