[hightemp]

Summary

• src/core/ig_normalize.{h,c}:
  • ig_url_decode() — one round: %XX, %uXXXX → UTF-8 (surrogates kept), + → space only with IG_DECODE_PLUS; invalid/truncated sequences copied as is (like PHP). Output never longer than input; in-place allowed.
  • ig_normalize() — up to rounds rounds (inletguard.decode_rounds, default 2, on top of PHP's own decode), each followed by NUL removal (so %%0041 → %41 → A); stops when stable; stats: rounds, nul_removed, limit_hit (still decodable after the last round — input for the anomaly class later).
  • No allocation, no state (ZTS-safe); IG_NORM_ERROR on NULL buffers.
• Fuzz target fuzz_normalize (output ≤ input, no NUL, in-place = separate buffer) with seeds.
• PRD note 1.4 in both languages.

Verified locally: unit (gcc, clang + ASan/UBSan, CentOS 7 gcc 4.8.5), clang-tidy, cppcheck, clang-format, phpt 7.0/8.5 ZTS, 30 s fuzzing per target (2.4M executions for the normalizer).

TDD

• red a8f3f77: tests/unit/test_normalize.c (12 tests).
• green: implementation.

🤖 Generated with Claude Code