Does URLSearchParams reject malformed percent text like decodeURIComponent does?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Destination observations run independently on the exact input and cleaned strings in the recorded Node runtime. We make no detector-score or statistical-watermark removal claim.

The same byte spelling produces an exception or replacement

We compare a strict component decoder with a q value parsed through URLSearchParams. For the %FF control, decodeURIComponent throws URIError, while the form parser returns a single replacement character, U+FFFD. Serializing that parameter object produces q=%EF%BF%BD. The saved code-point list identifies the replacement independently of how the browser renders it. Cleanup does not change the original ASCII percent spelling, so both branches repeat these results. Our earlier strict-decoder page records the exception but does not measure this form parser. The new matrix answers the receiving parser question and demonstrates a concrete representation change that a no-exception test would otherwise conceal.

Incomplete notation and interrupted notation follow other paths

For %4, the strict decoder throws, but the form value remains literal percent-four and its serialized form escapes the percent sign. The interrupted %4 plus U+200B plus 1 initially remains literal interrupted text through form parsing. Deleting the actual marker joins a valid %41 escape, and both decoders then produce A. The unmarked %41 control produces A throughout. Recording the form value, its code points and the serialized parameter string distinguishes accepted literal notation from decoded bytes and replacement output. The observer prefixes a fixed q= to tiny component strings; it does not parse arbitrary URLs, handle duplicate keys or test a server’s decoding library. No recursive decoding pass is performed.

Acceptance and preservation need separate requirements

If a receiving workflow must reject malformed encoded text, do not infer that requirement was satisfied just because URLSearchParams returned a string. Preserve the raw component alongside the decoded value and apply the documented validation policy at the correct stage. A replacement character does not reveal the original byte that failed, and resaving the decoded string cannot reconstruct that history. Conversely, retained percent text is not proof of successful percent decoding. The four fixtures give controls for rejection, literal retention, replacement and ordinary decoding. They establish these local operations only, not a universal URL sanitizer, an observed Claude export defect or a method for removing statistical watermarks. Use the downloadable script to test your actual parser boundary separately.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs