I wrote:
>>> Is that a yes or no to my "harmless character sequences"? These can
>>> handle data like URLs which might prompt people to go verbatim, but
>>> they aren't implemented using \catcode changes.
>> Not sure I understand -- even URLs need to sanitise % if they're used
>> within an argument.
> 
> I'm with Will: I'm not sure I follow :-(

Okay, I looked at the xdoc2 code and have some feel for what you mean, I
hope. I assume we are talking about \MakeHarmless, and applying it to
the input.  I can see that the space handling there is very careful, but
I wonder what other differences there are between doing \MakeHarmless
and using \detokenize (noting as Will has done that things like % have
to be handled as full-verbatim due to the nested-macro issue).
-- 
Joseph Wright