Why does decodeURI leave a cleaned percent-encoded slash unchanged?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Destination observations run independently on the exact input and cleaned strings in the recorded Node runtime. We make no detector-score or statistical-watermark removal claim.

Two successful decoders can produce different text

The first fixture interrupts the percent escape with a literal selected marker, so both decoders initially throw URIError. Cleaning repairs the spelling to a%2Fb. Now both calls succeed, but decodeURI retains the escaped slash while decodeURIComponent returns a literal slash. The multi-delimiter control keeps encoded slash, question mark, equals sign and hash under decodeURI; the component decoder turns each into punctuation. Both decode the ordinary encoded-space control to a space. Both also turn the ASCII spelling of the encoded marker into a real U+200B after the cleaner stage. Accepted status and output text are separate fields because success alone does not identify the resulting representation.

Retention is a decoding rule rather than failed cleanup

The earlier URI encoder guide compares the opposite conversion direction, and the percent-error guide focuses on rejection of malformed escapes. This matrix makes successful reserved-escape retention the central question. It calls the two JavaScript functions directly, without navigation, URL parsing or server routing. The raw percent characters are not themselves in the homepage removal set. The encoded-marker control additionally demonstrates that neither decoder is an invisible-character cleaner: a successful call can introduce the decoded character that was absent from the raw notation. We do not test repeated decoding, lowercase escape preservation, every reserved character, legacy encodings or form-plus behavior. Each observed string is limited to the explicit fixture and runtime.

Decode the representation at the intended argument boundary

Determine whether the source is a whole URI or component data before deciding which operation belongs in the pipeline. Preserve the raw spelling when escaped delimiters carry meaning for a later parser. Avoid assuming that a literal slash and an escaped slash route identically on a real destination; this experiment contacts no such endpoint. If decoded text needs inspection, inspect that stage separately instead of relying solely on the earlier character count. The multi-delimiter and space controls prevent interpreting every retained escape as a decoder failure. The downloads show exact before and after calls, with exceptions and successful values distinguished, providing reproducible evidence for the decoder choice without claiming a universal URL repair policy.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs