diff --git a/src/protect/engine/engine.js b/src/protect/engine/engine.js
index d616b80..d61ae85 100644
--- a/src/protect/engine/engine.js
+++ b/src/protect/engine/engine.js
@@ -536,6 +536,13 @@ function collectLeafValues(root, nodeCap = 20000, maxDepth = 1000) {
   return out;
 }
 
+// The inspection limits one evaluation reached, as `{ skips: [reason, …] }`, or nothing when it
+// reached none. Callers count each reason in their coverage.
+function skipsOf(resolver) {
+  const skips = resolver?.skips;
+  return skips && skips.length > 0 ? { skips } : {};
+}
+
 // Emit a warning at most once per distinct key (keeps a persistent misconfiguration from spamming).
 const warnedKeys = new Set();
 function warnOnce(key, message) {
@@ -1185,8 +1192,11 @@ export class RuleEngine {
     let normalizedReq;
     let resolver;
     try {
-      normalizedReq = { ...req, ...normalizeRequest(req) };
+      // Past the normalizer's depth bound a value is matched un-normalized; that is reported.
+      let limited = false;
+      normalizedReq = { ...req, ...normalizeRequest(req, { onLimit: () => { limited = true; } }) };
       resolver = new RequestResolver(normalizedReq);
+      if (limited) resolver.noteSkip('container-cap');
     } catch (err) {
       this.#reportError(err);
       return { blocked: false, rule: null, message: null }; // fail open
@@ -1219,7 +1229,8 @@ export class RuleEngine {
             // that re-read the request instead would be reading it a second time: a getter, a stream or
             // anything else that answers once can give a different value, and evidence that disagrees
             // with the match it belongs to is worse than none.
-            resolver
+            resolver,
+            ...skipsOf(resolver)
           };
         }
       } catch (err) {
@@ -1229,7 +1240,7 @@ export class RuleEngine {
       }
     }
 
-    return { blocked: false, rule: null, message: null };
+    return { blocked: false, rule: null, message: null, ...skipsOf(resolver) };
   }
 
   #evaluateRule(conditions, resolver) {
diff --git a/src/protect/engine/index.d.ts b/src/protect/engine/index.d.ts
index cef6924..8287bfd 100644
--- a/src/protect/engine/index.d.ts
+++ b/src/protect/engine/index.d.ts
@@ -44,6 +44,8 @@ export interface EvaluateResult {
   blocked: boolean;
   rule: FirewallRule | null;
   message: string | null;
+  /** Inspection limits this evaluation reached (e.g. `container-cap`), when it reached any. */
+  skips?: string[];
 }
 
 export declare class RuleEngine {
@@ -56,6 +58,8 @@ export declare class RequestResolver {
   constructor(req: any);
   resolve(parameter: string): any[];
   applyMutations(mutations: string[], value: any): any;
+  noteSkip(reason: string): void;
+  readonly skips: string[];
 }
 
 // Middleware
@@ -111,6 +115,8 @@ export interface NormalizeOptions {
   sqlComments?: boolean;
   nullBytes?: boolean;
   whitespace?: boolean;
+  /** Called when a nested value is past the depth bound and is kept un-normalized. */
+  onLimit?: () => void;
 }
 
 export declare function normalize(value: string, options?: NormalizeOptions): string;
diff --git a/src/protect/engine/normalizer.js b/src/protect/engine/normalizer.js
index 7b47c4f..186a15c 100644
--- a/src/protect/engine/normalizer.js
+++ b/src/protect/engine/normalizer.js
@@ -80,28 +80,45 @@ export function urlDecode(value) {
     while (result !== previous && iterations < MAX_DECODE_ITERATIONS) {
         previous = result;
         iterations++;
-
-        try {
-            result = decodeURIComponent(result);
-        } catch {
-            result = safeUrlDecode(result);
-            break;
-        }
+        result = safeUrlDecode(result);
     }
 
     return result;
 }
 
-function safeUrlDecode(value) {
-    return value.replace(/%([0-9A-Fa-f]{2})/g, (match, hex) => {
+const utf8 = new TextDecoder();
+
+/**
+ * Percent-decode every well-formed escape, whatever else the value contains.
+ *
+ * A `%` that does not start an escape is kept as it is, and does not stop the escapes around it from being
+ * decoded. Each run of escapes is decoded as UTF-8; bytes that are not valid UTF-8 become U+FFFD.
+ */
+export function safeUrlDecode(value) {
+    return value.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
         try {
-            return String.fromCharCode(parseInt(hex, 16));
+            return decodeURIComponent(run);
         } catch {
-            return match;
+            const bytes = new Uint8Array(run.length / 3);
+            for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(run.slice(i * 3 + 1, i * 3 + 3), 16);
+            return utf8.decode(bytes);
         }
     });
 }
 
+/**
+ * A request target with `+` in its query read as a space, the way query-string parsers read it.
+ *
+ * Only the query is affected: a `+` in the path is a literal `+`. Apply this before percent-decoding, so
+ * an encoded `%2B` still becomes a literal `+`.
+ */
+export function decodeQueryPlus(target) {
+    if (typeof target !== 'string') return target;
+    const query = target.indexOf('?');
+    if (query === -1) return target;
+    return target.slice(0, query + 1) + target.slice(query + 1).replace(/\+/g, ' ');
+}
+
 export function htmlEntityDecode(value) {
     if (typeof value !== 'string') {
         return value;
@@ -113,17 +130,40 @@ export function htmlEntityDecode(value) {
         result = result.split(entity).join(char);
     }
 
-    result = result.replace(/&#(\d+);/g, (match, code) => {
-        const num = parseInt(code, 10);
-        return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
-    });
+    return decodeHtmlEntities(result);
+}
 
-    result = result.replace(/&#x([0-9A-Fa-f]+);/g, (match, hex) => {
-        const num = parseInt(hex, 16);
-        return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
-    });
+/**
+ * Named entities decoded by `decodeHtmlEntities`: the ones that matter in injection contexts plus the
+ * handful every encoder emits. Numeric references are decoded generally, decimal and hex.
+ */
+const NAMED_ENTITIES = {
+    lt: '<', gt: '>', amp: '&', quot: '"', apos: "'",
+    nbsp: '\u00a0', sol: '/', bsol: '\\', colon: ':', lpar: '(', rpar: ')', equals: '=', grave: '`',
+    Tab: '\t', NewLine: '\n', semi: ';', excl: '!', num: '#', dollar: '$', percnt: '%', ast: '*',
+};
 
-    return result;
+/**
+ * Decode HTML character references in one pass.
+ *
+ * The terminating `;` is optional, as it is for a browser reading a numeric reference: `&#58` and
+ * `&#x3a` decode like `&#58;`. One pass means `&amp;lt;` becomes `&lt;`, not `<`.
+ */
+export function decodeHtmlEntities(input) {
+    return input.replace(/&(#[xX][0-9a-fA-F]+|#\d+|[A-Za-z][A-Za-z0-9]*);?/g, (whole, body) => {
+        if (body[0] === '#') {
+            const hex = body[1] === 'x' || body[1] === 'X';
+            const code = Number.parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
+            if (!Number.isFinite(code) || code < 0 || code > 0x10ffff) return whole;
+            try {
+                return String.fromCodePoint(code);
+            } catch {
+                return whole;
+            }
+        }
+
+        return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, body) ? NAMED_ENTITIES[body] : whole;
+    });
 }
 
 export function removeSqlComments(value) {
@@ -352,41 +392,69 @@ export function normalizeRequest(req, options = {}) {
         query: normalizeObject(requestField(req, 'query') || {}, options),
         body: normalizeObject(body || {}, options),
         headers: normalizeObject(requestField(req, 'headers') || {}, options),
-        url: normalize(url || '', options),
-        originalUrl: normalize(requestField(req, 'originalUrl') || url || '', options),
+        url: normalize(decodeQueryPlus(url || ''), options),
+        originalUrl: normalize(decodeQueryPlus(requestField(req, 'originalUrl') || url || ''), options),
         _rawBody: rawBody
     };
 }
 
-// Depth bound for the recursive walk: a pathologically deep object would otherwise overflow the
-// stack, and the engine's per-rule catch would swallow that into a fail-open. Beyond the bound the
-// sub-value is left un-normalized (still matched, just in its raw form) rather than crashing.
-const MAX_NORMALIZE_DEPTH = 200;
+// The same depth bound as the engine's leaf walk, so every value that walk reaches is normalized. Past
+// it a sub-value is kept as it is (still matched, in its raw form) and `options.onLimit` is called.
+const MAX_NORMALIZE_DEPTH = 1000;
 
+/**
+ * A copy of `value` with every string inside it normalized.
+ *
+ * Iterative, so depth cannot overflow the stack; the work is linear in the size of the value. A shared
+ * or cyclic node is copied once, and array holes stay holes.
+ */
 export function normalizeObject(value, options = {}, depth = 0) {
     if (typeof value === 'string') {
         return normalize(value, options);
     }
 
-    if (depth >= MAX_NORMALIZE_DEPTH) {
+    if (value === null || typeof value !== 'object') {
         return value;
     }
 
-    if (Array.isArray(value)) {
-        return value.map(item => normalizeObject(item, options, depth + 1));
+    if (depth >= MAX_NORMALIZE_DEPTH) {
+        options.onLimit?.();
+        return value;
     }
 
-    if (typeof value === 'object' && value !== null) {
-        const result = {};
-
-        for (const [key, val] of Object.entries(value)) {
-            setOwn(result, key, normalizeObject(val, options, depth + 1));
+    const copies = new Map();
+    const copyOf = (node) => {
+        const copy = Array.isArray(node) ? new Array(node.length) : {};
+        copies.set(node, copy);
+        return copy;
+    };
+    const top = copyOf(value);
+    const stack = [[value, top, depth]];
+
+    while (stack.length > 0) {
+        const [node, copy, level] = stack.pop();
+
+        for (const key of Object.keys(node)) {
+            const child = node[key];
+
+            if (typeof child === 'string') {
+                setOwn(copy, key, normalize(child, options));
+            } else if (child === null || typeof child !== 'object') {
+                setOwn(copy, key, child);
+            } else if (copies.has(child)) {
+                setOwn(copy, key, copies.get(child));
+            } else if (level + 1 >= MAX_NORMALIZE_DEPTH) {
+                setOwn(copy, key, child);
+                options.onLimit?.();
+            } else {
+                const childCopy = copyOf(child);
+                setOwn(copy, key, childCopy);
+                stack.push([child, childCopy, level + 1]);
+            }
         }
-
-        return result;
     }
 
-    return value;
+    return top;
 }
 
 export function createMatchVariants(value) {
diff --git a/src/protect/engine/request.js b/src/protect/engine/request.js
index 8f9c947..dba6a01 100644
--- a/src/protect/engine/request.js
+++ b/src/protect/engine/request.js
@@ -1,3 +1,4 @@
+import { decodeHtmlEntities, safeUrlDecode } from './normalizer.js';
 import { setOwn } from './own.js';
 
 // Resolvable DATA attributes of an uploaded file part (files.<name>.<attr>). The engine only exposes
@@ -22,55 +23,70 @@ export function base64DecodeUtf8(value) {
   return new TextDecoder().decode(bytes);
 }
 
+// Mutations that decode one string into another.
+const TEXT_MUTATIONS = new Set(['base64_decode', 'urldecode', 'htmlentitydecode']);
+
+// Same bounds as the engine's leaf walk: beyond them a node is kept as it is, still matched undecoded.
+const MAX_MAPPED_NODES = 20000;
+const MAX_MAPPED_DEPTH = 1000;
+
 /**
- * Decode HTML entities, so a payload written as `&lt;script&gt;` is screened as `<script>`.
- *
- * The mutation was documented, used by a shipped rule, and not implemented — so it was applied as a silent
- * no-op. Implemented here to make the name mean what it says, NOT to close a coverage gap: `normalizer.js`
- * already decodes entities across the whole request before matching, iteratively, which is why the
- * entity-encoded payloads that rule exists for were being caught anyway. Anyone reading this should not
- * conclude that entity coverage depended on this mutation; it did not, and the contract test is what turned
- * "the name does nothing" into something visible.
- *
- * Named entities are limited to the ones that matter for injection contexts plus the handful every encoder
- * emits. A full entity table would be a dependency, and the gap it leaves is a payload encoded with an
- * exotic named entity — which no encoder in this path produces. Numeric forms are handled generally, both
- * decimal and hex, because those are what an attacker writes by hand.
+ * A copy of `root` with `fn` applied to every string leaf. Iterative and bounded, so an oversized or
+ * deeply nested value cannot overflow the stack; a shared or cyclic node is copied once.
  */
-const NAMED_ENTITIES = {
-  lt: '<', gt: '>', amp: '&', quot: '"', apos: "'", '#39': "'",
-  nbsp: '\u00a0', sol: '/', bsol: '\\', colon: ':', lpar: '(', rpar: ')', equals: '=', grave: '`',
-  Tab: '\t', NewLine: '\n', semi: ';', excl: '!', num: '#', dollar: '$', percnt: '%', ast: '*',
-};
-
-function decodeHtmlEntities(input) {
-  // One pass. Decoding repeatedly would turn `&amp;lt;` into `<`, which is not what a browser does — and a
-  // guard that decodes further than the sink does is a guard that blocks strings the app never sees.
-  return input.replace(/&(#[xX]?[0-9a-fA-F]+|[A-Za-z][A-Za-z0-9]*);?/g, (whole, body) => {
-    if (body[0] === '#') {
-      const hex = body[1] === 'x' || body[1] === 'X';
-      const code = Number.parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
-      if (!Number.isFinite(code) || code < 0 || code > 0x10ffff) return whole;
-      try {
-        return String.fromCodePoint(code);
-      } catch {
-        return whole;
+function mapStringLeaves(root, fn) {
+  const copies = new Map();
+  const copyOf = (node) => {
+    const copy = Array.isArray(node) ? [] : {};
+    copies.set(node, copy);
+    return copy;
+  };
+  const top = copyOf(root);
+  const stack = [[root, top, 0]];
+  let visited = 0;
+  while (stack.length) {
+    const [node, copy, depth] = stack.pop();
+    visited++;
+    for (const key of Object.keys(node)) {
+      const child = node[key];
+      if (typeof child === 'string') {
+        setOwn(copy, key, fn(child));
+      } else if (child === null || typeof child !== 'object') {
+        setOwn(copy, key, child);
+      } else if (copies.has(child)) {
+        setOwn(copy, key, copies.get(child));
+      } else if (depth + 1 >= MAX_MAPPED_DEPTH || visited + stack.length >= MAX_MAPPED_NODES) {
+        setOwn(copy, key, child);
+      } else {
+        const childCopy = copyOf(child);
+        setOwn(copy, key, childCopy);
+        stack.push([child, childCopy, depth + 1]);
       }
     }
-
-    return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, body) ? NAMED_ENTITIES[body] : whole;
-  });
+  }
+  return top;
 }
 
 export class RequestResolver {
   #req;
   #cookies;
+  #skips = new Set();
 
   constructor(req) {
     this.#req = req;
     this.#cookies = null;
   }
 
+  /** Record an inspection limit this evaluation reached (reported once per reason). */
+  noteSkip(reason) {
+    this.#skips.add(reason);
+  }
+
+  /** The inspection limits recorded so far, in the order first reached. */
+  get skips() {
+    return [...this.#skips];
+  }
+
   resolve(parameter) {
     if (!parameter || parameter === 'false') {
       return [null];
@@ -175,6 +191,12 @@ export class RequestResolver {
       return value;
     }
 
+    // A text decoder applied to a structured value decodes each string inside it and keeps the structure,
+    // so the matcher still sees every leaf.
+    if (typeof value === 'object' && TEXT_MUTATIONS.has(mutation)) {
+      return mapStringLeaves(value, (leaf) => this.#applyMutation(mutation, leaf));
+    }
+
     switch (mutation) {
       case 'base64_decode':
         try {
@@ -198,11 +220,8 @@ export class RequestResolver {
         }
 
       case 'urldecode':
-        try {
-          return decodeURIComponent(String(value));
-        } catch {
-          return value;
-        }
+        // Form decoding: `+` is a space, and every well-formed escape is decoded even beside a stray `%`.
+        return safeUrlDecode(String(value).replace(/\+/g, ' '));
 
       case 'htmlentitydecode':
         return decodeHtmlEntities(String(value));
diff --git a/src/protect/runtime.js b/src/protect/runtime.js
index 51575f0..595dace 100644
--- a/src/protect/runtime.js
+++ b/src/protect/runtime.js
@@ -445,6 +445,10 @@ export async function createProtection(options = {}) {
     // lands after a try/catch here would have returned.
     notify(onSkip, { phase, reason, detail, count: skipCounts[key] }, 'onSkip');
   };
+  // The inspection limits a request-phase evaluation reached (see RuleEngine#evaluate).
+  const recordEvaluationSkips = (result) => {
+    for (const reason of result?.skips ?? []) recordSkip('request', reason);
+  };
 
   const maskFn =
     typeof options.maskWith === 'function'
@@ -535,6 +539,7 @@ export async function createProtection(options = {}) {
     const redactions = [];
     const headerMutations = [];
     let lowerText = null; // lazily lowercased body, only if a rule uses a prefilter
+    const responseSkips = new Set(); // each inspection limit counted once per response
     for (const { rule, engine: re, redactors, prefilter, mutatedSpan } of responseRuleSet) {
       // `only` narrows the set to the rules a caller is entitled to run. The no-body path uses it to
       // exclude every rule that reads the body, rather than evaluating one against an empty string —
@@ -557,6 +562,11 @@ export async function createProtection(options = {}) {
         notify(onError, err, 'onError');
         continue;
       }
+      for (const reason of result.skips ?? []) {
+        if (responseSkips.has(reason)) continue;
+        responseSkips.add(reason);
+        recordSkip('response', reason);
+      }
       if (!result.blocked) continue;
       // Per-rule enforcement applies to every phase, not just the request. A generated response rule in
       // dry-run must not redact or withhold a body either: "detect until justified" is meaningless if the
@@ -705,6 +715,7 @@ export async function createProtection(options = {}) {
         recordSkip('request', shaped._bodyInspectionSkip, { limit: options.maxBodyBytes ?? 1024 * 1024 });
       }
       result = engine.evaluate(shaped);
+      recordEvaluationSkips(result);
     } catch (err) {
       notify(onError, err, 'onError');
 
@@ -1484,6 +1495,7 @@ export async function createProtection(options = {}) {
         const { shaped, client } = shapeExpressRequest(req);
         try {
           result = engine.evaluate(shaped);
+          recordEvaluationSkips(result);
         } catch (err) {
           notify(onError, err, 'onError');
           if (exprOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req, client));
@@ -1555,6 +1567,7 @@ export async function createProtection(options = {}) {
           shaped = fromNodeRequest(req, rawBody, { trustedProxy: options.trustedProxy });
           if (parsedBody !== undefined && parsedBody !== null) shaped.body = parsedBody;
           result = engine.evaluate(shaped);
+          recordEvaluationSkips(result);
         } catch (err) {
           notify(onError, err, 'onError');
           return next();
diff --git a/tests/protect/request-decoding.test.ts b/tests/protect/request-decoding.test.ts
new file mode 100644
index 0000000..d0223c2
--- /dev/null
+++ b/tests/protect/request-decoding.test.ts
@@ -0,0 +1,279 @@
+import { describe, expect, it } from 'vitest';
+import { RuleEngine } from '../../src/protect/engine/engine.js';
+import { RequestResolver } from '../../src/protect/engine/request.js';
+import {
+  decodeHtmlEntities, normalizeObject, normalizeRequest, safeUrlDecode, urlDecode,
+} from '../../src/protect/engine/normalizer.js';
+import { createProtection } from '../../src/protect/runtime.js';
+
+// Every value below is synthetic. Each case pairs a request the rule must match with one it must not, so a
+// decoder that matches everything fails as surely as one that matches nothing.
+
+function request(overrides: Record<string, unknown> = {}) {
+  return { method: 'GET', url: '/', originalUrl: '/', query: {}, body: {}, headers: {}, ...overrides };
+}
+
+function blocks(condition: object, req: object) {
+  const engine = new RuleEngine({ firewall: [{ id: 1, title: 'sample', rule_v2: [condition] }] });
+  return engine.evaluate(req).blocked;
+}
+
+async function guardBlocks(condition: object, req: Request) {
+  const protection: any = await createProtection({
+    mode: 'block',
+    rules: { firewall: [{ id: 1, title: 'sample', rule_v2: [condition] }], whitelists: [], whitelist_keys: {} },
+  });
+  return (await protection.fetchGuard()(req)) !== null;
+}
+
+describe('percent-decoding beside a stray %', () => {
+  it('decodes the escapes around a % that starts no escape', () => {
+    expect(safeUrlDecode('100% %53AMPLE')).toBe('100% SAMPLE');
+    expect(safeUrlDecode('%zz%41')).toBe('%zzA');
+  });
+
+  it('decodes multi-byte UTF-8 runs and replaces bytes that are not UTF-8', () => {
+    expect(safeUrlDecode('50% caf%C3%A9')).toBe('50% café');
+    expect(safeUrlDecode('%41%FF%42')).toBe('A�B');
+  });
+
+  it('keeps decoding repeated encodings when the value also holds a stray %', () => {
+    expect(urlDecode('50% %253Csample%253E')).toBe('50% <sample>');
+  });
+
+  it('applies the urldecode mutation to a raw body containing a stray %', async () => {
+    const condition = { parameter: 'raw', mutations: ['urldecode'], match: { type: 'contains', value: 'SAMPLE_TOKEN' } };
+    const body = (text: string) => new Request('https://app.example.test/', { method: 'POST', headers: { 'content-type': 'text/plain' }, body: text });
+    expect(await guardBlocks(condition, body('100% %53AMPLE_TOKEN'))).toBe(true);
+    expect(await guardBlocks(condition, body('100% %53AMPLE_OTHER'))).toBe(false);
+  });
+});
+
+describe('+ in form and query data', () => {
+  it('reads + as a space in the query of REQUEST_URI and all', () => {
+    for (const parameter of ['server.REQUEST_URI', 'all']) {
+      const condition = { parameter, match: { type: 'contains', value: 'sample value' } };
+      expect(blocks(condition, request({ url: '/search?q=sample+value', originalUrl: '/search?q=sample+value' }))).toBe(true);
+      expect(blocks(condition, request({ url: '/search?q=sample-value', originalUrl: '/search?q=sample-value' }))).toBe(false);
+    }
+  });
+
+  it('reads + as a space in a request target given only as url', () => {
+    const normalized = normalizeRequest({ url: '/search?q=sample+value&r=a%2Bb' });
+    expect(normalized.url).toBe('/search?q=sample value&r=a+b');
+    expect(normalized.originalUrl).toBe('/search?q=sample value&r=a+b');
+    expect(normalizeRequest({ url: '/a+b?q=sample-value' }).url).toBe('/a+b?q=sample-value');
+  });
+
+  it('reads + as a space in url and originalUrl independently', () => {
+    const normalized = normalizeRequest({ url: '/inner?q=first+value', originalUrl: '/outer?q=second+value' });
+    expect(normalized.url).toBe('/inner?q=first value');
+    expect(normalized.originalUrl).toBe('/outer?q=second value');
+  });
+
+  it('keeps an encoded + and a + in the path literal', () => {
+    const literal = { parameter: 'server.REQUEST_URI', match: { type: 'contains', value: 'a+b' } };
+    expect(blocks(literal, request({ originalUrl: '/search?q=a%2Bb' }))).toBe(true);
+    expect(blocks(literal, request({ originalUrl: '/search?q=a+b' }))).toBe(false);
+    expect(blocks(literal, request({ originalUrl: '/a+b?q=1' }))).toBe(true);
+  });
+
+  it('keeps path scoping on a + in the path', () => {
+    const engine = new RuleEngine({
+      firewall: [{ id: 1, title: 'sample', when: { path: '/a+b' }, rule_v2: [{ parameter: 'get.q', match: { type: 'isset' } }] }],
+    });
+    expect(engine.evaluate(request({ originalUrl: '/a+b?q=1', query: { q: '1' } })).blocked).toBe(true);
+    expect(engine.evaluate(request({ originalUrl: '/a b?q=1', query: { q: '1' } })).blocked).toBe(false);
+  });
+
+  it('reads + as a space in the urldecode mutation', async () => {
+    const condition = { parameter: 'raw', mutations: ['urldecode'], match: { type: 'contains', value: 'sample value' } };
+    const form = (text: string) => new Request('https://app.example.test/', {
+      method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: text,
+    });
+    expect(await guardBlocks(condition, form('q=sample+value'))).toBe(true);
+    expect(await guardBlocks(condition, form('q=sample%2Bvalue'))).toBe(false);
+  });
+});
+
+describe('HTML character references', () => {
+  it.each([
+    ['javascript&colon;run()', 'a named reference'],
+    ['javascript&#58run()', 'a decimal reference without ;'],
+    ['javascript&#x3arun()', 'a hex reference without ;'],
+    ['javascript&#X3A;run()', 'an upper-case hex marker'],
+  ])('decodes %s (%s) before matching', (value) => {
+    const condition = { parameter: 'get.u', match: { type: 'contains', value: 'javascript:' } };
+    expect(blocks(condition, request({ query: { u: value } }))).toBe(true);
+    expect(blocks(condition, request({ query: { u: 'javascript-run()' } }))).toBe(false);
+  });
+
+  it('keeps the text that follows a reference without ;', () => {
+    expect(decodeHtmlEntities('&#58abc')).toBe(':abc');
+    expect(decodeHtmlEntities('&#x3a-xyz')).toBe(':-xyz');
+    expect(decodeHtmlEntities('&unknown;')).toBe('&unknown;');
+  });
+
+  it('decodes one level in the htmlentitydecode mutation', () => {
+    const resolver = new RequestResolver(request());
+    expect(resolver.applyMutations(['htmlentitydecode'], '&amp;lt;')).toBe('&lt;');
+  });
+});
+
+describe('text mutations on structured values', () => {
+  const nested = (value: unknown) => request({ method: 'POST', body: { user: value } });
+
+  it.each([
+    ['urldecode', { profile: { name: '%3Csample%3E' } }, { profile: { name: 'sample' } }],
+    ['base64_decode', { profile: { name: btoa('<sample>') } }, { profile: { name: btoa('sample') } }],
+    ['htmlentitydecode', { list: ['plain', '&lt;sample&gt;'] }, { list: ['plain', 'sample'] }],
+  ])('%s decodes each nested string', (mutation, hit, miss) => {
+    const condition = { parameter: 'post.user', mutations: [mutation], match: { type: 'contains', value: '<sample>' } };
+    expect(blocks(condition, nested(hit))).toBe(true);
+    expect(blocks(condition, nested(miss))).toBe(false);
+  });
+
+  it('keeps the structure for a structural match after decoding', () => {
+    const condition = {
+      parameter: 'post.user', mutations: ['urldecode'],
+      match: { type: 'array_key_value', key: 'items.role', match: { type: 'equals', value: 'admin user' } },
+    };
+    expect(blocks(condition, nested({ items: [{ role: 'guest' }, { role: 'admin+user' }] }))).toBe(true);
+    expect(blocks(condition, nested({ items: [{ role: 'guest' }] }))).toBe(false);
+  });
+
+  it('decodes JSON-decoded containers leaf by leaf', () => {
+    const condition = { parameter: 'post.data', mutations: ['json_decode', 'urldecode'], match: { type: 'contains', value: '<sample>' } };
+    const body = (inner: unknown) => request({ method: 'POST', body: { data: JSON.stringify(inner) } });
+    expect(blocks(condition, body({ deep: [{ value: '%3Csample%3E' }] }))).toBe(true);
+    expect(blocks(condition, body({ deep: [{ value: 'sample' }] }))).toBe(false);
+  });
+
+  it('leaves non-string leaves and the original value unchanged', () => {
+    const value = { count: 3, flag: true, none: null, text: '%41' };
+    const resolver = new RequestResolver(request());
+    expect(resolver.applyMutations(['urldecode'], value)).toEqual({ count: 3, flag: true, none: null, text: 'A' });
+    expect(value.text).toBe('%41');
+  });
+
+  it('terminates on a cyclic value', () => {
+    const value: Record<string, unknown> = { text: '%3Csample%3E' };
+    value.self = value;
+    const resolver = new RequestResolver(request());
+    const decoded = resolver.applyMutations(['urldecode'], value) as Record<string, unknown>;
+    expect(decoded.text).toBe('<sample>');
+    expect(decoded.self).toBe(decoded);
+  });
+
+  it('decodes within its bounds on a deeply nested value without throwing', () => {
+    let value: Record<string, unknown> = { text: '%41' };
+    for (let i = 0; i < 50_000; i++) value = { next: value, text: '%41' };
+    const resolver = new RequestResolver(request());
+    const decoded = resolver.applyMutations(['urldecode'], value) as Record<string, unknown>;
+    expect(decoded.text).toBe('A');
+    expect((decoded.next as Record<string, unknown>).text).toBe('A');
+  });
+
+  it('keeps an own __proto__ key as data', () => {
+    const value = JSON.parse('{"__proto__":{"text":"%3Csample%3E"}}');
+    const resolver = new RequestResolver(request());
+    const decoded = resolver.applyMutations(['urldecode'], value);
+    expect(Object.getPrototypeOf(decoded)).toBe(Object.prototype);
+    expect(Object.getOwnPropertyDescriptor(decoded, '__proto__')?.value).toEqual({ text: '<sample>' });
+  });
+});
+
+describe('normalization depth', () => {
+  // `levels` nested objects, the innermost holding `text`: the top object is level 0, the innermost is
+  // level `levels - 1`.
+  const nest = (levels: number, text: string) => {
+    let value: Record<string, unknown> = { text };
+    for (let i = 1; i < levels; i++) value = { next: value };
+    return value;
+  };
+  const innermost = (value: any): any => (value.next ? innermost(value.next) : value);
+
+  it('normalizes a value at the deepest level inside the bound, without reporting a limit', () => {
+    let limits = 0;
+    const out = normalizeObject(nest(1000, '%3Csample%3E'), { onLimit: () => { limits++; } });
+    expect(innermost(out).text).toBe('<sample>');
+    expect(limits).toBe(0);
+  });
+
+  it('keeps a value one level past the bound as it is, and reports the limit', () => {
+    let limits = 0;
+    const out = normalizeObject(nest(1001, '%3Csample%3E'), { onLimit: () => { limits++; } });
+    expect(innermost(out).text).toBe('%3Csample%3E');
+    expect(limits).toBe(1);
+  });
+
+  it('reports a limit reached at the top of the walk', () => {
+    let limits = 0;
+    const value = { text: '%41' };
+    expect(normalizeObject(value, { onLimit: () => { limits++; } }, 1000)).toBe(value);
+    expect(limits).toBe(1);
+  });
+
+  it('normalizes nested values well past a few hundred levels', () => {
+    const condition = { parameter: 'post.data', match: { type: 'contains', value: '<sample>' } };
+    const deep = (text: string) => request({ method: 'POST', body: { data: nest(500, text) } });
+    expect(blocks(condition, deep('%3Csample%3E'))).toBe(true);
+    expect(blocks(condition, deep('%3Cother%3E'))).toBe(false);
+  });
+
+  it('normalizes a cyclic value once per node', () => {
+    const value: Record<string, unknown> = { text: '%41' };
+    value.self = value;
+    const out = normalizeObject(value) as Record<string, unknown>;
+    expect(out.text).toBe('A');
+    expect(out.self).toBe(out);
+  });
+
+  it('keeps array holes and non-string leaves', () => {
+    const value = [1, , '%41', null, true];
+    const out = normalizeObject(value) as unknown[];
+    expect(out).toHaveLength(5);
+    expect(1 in out).toBe(false);
+    expect(out).toEqual([1, undefined, 'A', null, true]);
+    expect(normalizeObject(['%41', , ]) as unknown[]).toHaveLength(2);
+  });
+
+  async function screened(body: unknown, onSkip: (event: any) => void, parameter = 'post.data') {
+    const protection: any = await createProtection({
+      mode: 'dry-run',
+      rules: { firewall: [{ id: 1, title: 'sample', rule_v2: [{ parameter, match: { type: 'isset' } }] }], whitelists: [], whitelist_keys: {} },
+      onSkip,
+    });
+    const guard = protection.fetchGuard();
+    const send = () => guard(new Request('https://app.example.test/', {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+    }));
+    return { protection, send };
+  }
+
+  it('reports a request past the bound as a container-cap skip, once per request', async () => {
+    const skips: any[] = [];
+    const { protection, send } = await screened({ data: nest(1001, 'sample'), more: nest(1001, 'sample') }, (event) => skips.push(event));
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBe(1);
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBe(2);
+    expect(skips.map((event) => [event.phase, event.reason])).toEqual([['request', 'container-cap'], ['request', 'container-cap']]);
+  });
+
+  it('reports the skip when no rule matches the request', async () => {
+    const skips: any[] = [];
+    const { protection, send } = await screened({ data: nest(1001, 'sample') }, (event) => skips.push(event), 'post.absent');
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBe(1);
+    expect(skips).toHaveLength(1);
+  });
+
+  it('reports nothing for a request inside the bound', async () => {
+    const skips: any[] = [];
+    const { protection, send } = await screened({ data: nest(999, 'sample') }, (event) => skips.push(event));
+    await send();
+    expect(protection.coverage().skipped['request:container-cap']).toBeUndefined();
+    expect(skips).toEqual([]);
+  });
+});