{ "summary": "YES: ordinary operator text containing literal " reaches both Claude adapter report calls unchanged (state busy payload and now-signal --user-input). Ordinary actual quotes are NOT XML-escaped on that hook/report path. Peer-delivery-generated escaped quotes are blocked from state-busy USER_INPUT by explicit stub/ --session-id --payload-stdin`, with that string as stdin. SysEnv::spt_strict_stdin():5016–5029 uses Command::args plus write_all(body.as_bytes()), with no XML transform. On refusal it retries a payload-free busy mark, rather than publishing alternate text.\n\nSeparately, hook.rs:3263–3277 polls now-signal when prompt is nonblank and identity exists. skill_key(prompt).is_empty() permits turn text; a recognized adapter skill invocation suppresses it. now_signal_arg():4089–4091 trims and takes at most 4000 Unicode characters; it does not decode or encode entities. now_signal_poll():4039–4043 passes that string as a single --user-input argv value. SysEnv::spt_with_env():4954–4955 uses Command::args, not shell interpolation.\n\nThus a normal prompt `Please inspect "C:/work/a.txt"` can supply exactly that entity-bearing text to BOTH calls (assuming text fits the now-signal cap and API accepts the report). A normal prompt `Please inspect \"C:/work/a.txt\"` supplies actual quotes to BOTH calls; this adapter does not manufacture " from those quotes. This is a real authored-input path, distinct from message rendering.\n\n## 2. Core-origin peer message: normal stub route decodes only at additionalContext boundary\nCurrent core checkout event.rs:446 serializes body via event_body_escape; envelope.rs:38–45 encodes ampersand first, then < > and double quote, then normalizes CRLF/CR and encodes LF as
. A body containing actual `\"C:/work/a.txt\"` therefore becomes `"C:/work/a.txt"` inside EVENT. A sender literally typing `"C:/work/a.txt"` instead produces `&quot;C:/work/a.txt&quot;`.\n\nActual current Claude translator DOES NOT universally decode this before PTY injection. Normal message-like delivery follows translate.rs:634–638: stub_delivery() recognizes an EVENT with nonempty body and usable from attribute (395–412), park_envelope() writes the raw envelope to the home-anchored msgpark directory (452–469), then commands_for_msg_stub() types only `` and discrete Enter (418–427). No filepath/body is in the hook prompt on this route.\n\nThe UserPromptSubmit hook drains parked raw envelopes (3140 onward) and renders them separately into `out`. render_frames():425–427 extracts the body then calls unescape; unescape():235–240 changes
to LF, </>/" to their characters, and & LAST. The body therefore yields actual quotes when core encoded actual quotes, but preserves literal " when that was sender-authored. render_frames():461–475 retains unconsumed attribute values in escaped wire form and emits `\\n{body}\\n`. This is hook additionalContext, not a replacement of the variable `prompt` and not a state USER_INPUT payload. Poll delivery similarly renders into `out` after the busy report.\n\nThe stub itself is rejected by user_input_payload, so state busy carries no USER_INPUT body for this peer turn. now-signal is NOT guarded by user_input_payload and normally gets the tiny `` string, not the parked peer body. Wake similarly types ``; its actual parked directive is injected separately into additionalContext.\n\n## 3. Real full-envelope route: escaped body CAN enter now-signal, cannot enter busy USER_INPUT\nThere is a concrete source-reachable full path, not just historical behavior:\n- Structured `json` attr carrying {\"full_inject\":\"v1\"} is decoded/recognized by translate.rs:350–357, and dispatch_event():634 bypasses stub+park.\n- Park failure (no initialized endpoint, no HOME/USERPROFILE, filesystem failure) also falls through at 639–645.\n- An ineligible stub envelope, e.g. empty body carrying attrs, likewise falls through.\n\ncommands_for_event():537–552 changes raw CR/LF to spaces, inserts structural newlines through frame_envelope(), and emits the complete EVENT as text. It NEVER entity-decodes the body. Thus actual quoted peer paths are still "path" in the physical prompt under this path. After Claude passes the prompt as hook JSON, serde_json preserves these entity bytes.\n\nState busy: user_input_payload():4113 rejects every trimmed prompt starting ` --session --spec-manifest --user-input `. This is a concrete adapter-side consumer seam worth routing to the claude-spt hook/report owner if the intended now-signal contract forbids peer text there. It is NOT proof that now-signal republishes a core USER_INPUT event; the two API surfaces must not be conflated. Core consumer behavior/conclusion remains parent's investigation.\n\n## 4. Probe invocation, not executed\n`claude-spt translate` is documented in main.rs:89 and translate.rs:30–40 as a stdin/stdout JSON-lines filter. It is NOT generally non-mutating: init starts interrupt_watch (translate.rs:702–708) and ordinary initialized delivery writes park files. There is no dedicated dry-run flag in the inspected entry point (reads no argv).\n\nA specifically non-mutating, source-grounded offline full-envelope probe can omit init and use the full_inject override, avoiding both watcher and park; stdout is only choreography JSON, not applied to any PTY. Example PowerShell invocation for parent consideration:\n\n'{\"type\":\"event\",\"envelope\":\"Inspect "C:/work/a.txt"\"}' | & 'C:/Users/decid/AppData/Local/spt-core/adapters/_github/SaberMage-claude-spt/claude-spt.exe' translate\n\nExpected from CHECKOUT SOURCE, not observed executable output: a text command containing the framed EVENT with "C:/work/a.txt" intact, surrounded by stash/delay/Enter/commit commands. Do not use init merely to probe: it adds real effects.\n\n## Bounded conclusion\nThe source census establishes YES for literal operator-authored " on both report calls; no XML encoding of ordinary operator quotes; NO peer body on state-busy USER_INPUT through the checked normal/stale/full-envelope routes due to explicit guard; and YES adapter-generated XML entities can survive a real full-envelope route into now-signal --user-input. Normal stub delivery decodes message bodies only in additionalContext. No tests, builds, formatters, runtime probes, edits, remote access, lifecycle operations, or fleet messages were performed. These findings are limited to the named Claude adapter paths and current source; they do not assert universal absence across harnesses or binary provenance." }