One decode pass avoids hidden delimiter changes
The decoder follows decodeURIComponent. Literal plus remains plus; use the query parser when plus-as-space form semantics are required.
Malformed percent triplets, truncated sequences, and invalid UTF-8 fail. Successful output includes a one-pass disclosure.