Work around is to replace all % with %25 like this:
dump(Canonicalize('10%25', true, true, true));
Feels like a hack for a Java bug, and I’m curious why URLDecoder is involved when it’s just a string argument and not necessarily a url, but is this the proper and reliable way to prep for what Canonicalize() expects, or is it a bug that Canonicalize() isn’t auto-replacing % before calling URLDecoder?