## W1 — quoted paths and duplicate helper receipts

Refs BigscreenVR/spt-bs-releases#317; milestone BigscreenVR/spt-bs-releases#318. This intentionally does **not** close #317: W2 owns second-audience/session reuse (#319) and prompt-time delivery.

Current head: `cd0e4216ef034955e4ea5fa38ede62f11acd1075`. W1 was rebased onto ruled main `6ea6f9a2` (landed IR-144). Lane/native-proof base was `b33aedcae51fa5ffa840ef1b36c9989a25884bdc`; the rebase added only CI scripts/workflow, infrastructure docs and requirement-registry changes. The final gate fixup adds two unmatched-quote regression tests and clarifies that contract; production logic is unchanged.

### Changes
- Recognize complete double-quoted, single-quoted and backtick-quoted spans before splitting their contents on whitespace. Windows, POSIX and home-rooted paths retain spaces; adjacent quoted paths remain separate. Fixed-point trimming, anchoring, input order, dedupe and the five-path cap remain. The existing prompt gate uses this same extractor. Candidate iteration stops at the cap rather than scanning the remaining prompt. Unquoted whitespace-bearing paths remain outside the documented contract.
- Collapse identical emitted `spt fetch` lines within each gather, across both attachment and helper-record sources. Consume every source delta key before suppressing output, preventing a duplicate from leaking into the next poll. Preserve first-occurrence order. The bounded gather uses its existing output vector rather than allocating another set; lookup is linear in already-emitted lines.
- Normalize leading/trailing ASCII whitespace for core receipt identity, preserving interior bytes, non-ASCII whitespace, session isolation, first-controller custody and the first deadline.
- Register `REQ-HELPER-QUOTED-SPAN-PATHS`, `REQ-HELPER-EMITTED-LINE-DEDUPE` and `REQ-INPUT-RECEIPT-TRIMMED-DEDUPE` before implementation; add doc/impl/unit evidence together. Update the serving guide, authoritative input contract, ADR-0058 Amendment 2 and generated changelog.
- Gate fixup: an unterminated Windows quote offers no directory fragment; a complete path preceding it remains eligible. Both cases are explicit regressions; serving documentation and the existing requirement state the termination rule.

### Duplicate-record RCA and certainty boundary
The incident has two helper UUIDs, `3919de80-fa8b-4240-bbd4-8d0257413ad0` and `774ce64c-be6d-49c2-9321-8ade7fbc1106`, 107ms apart for the same path/URL. The recorded USER_INPUT retains a trailing LF; the adapter hook trace has one matching UserPromptSubmit invocation.

Inspected source reports original prompt bytes through `state` and trimmed/capped text through `now-signal`. Both core entry points report input; the old receipt book hashed exact bytes. The native regression proves the whitespace-sensitive double-admission defect, and the fix preserves the first receipt for original/trimmed forms. Doyle accepted this scope; emitted-line dedupe remains the backstop.

**Limitation:** retained records do not map receipt UUIDs to payload hashes or reporting callsites, and the local adapter checkout is not a deployed-binary attestation. Assigning the first UUID to state and the second to now-signal remains an inference, not a proven historical mapping. This change does not declare arbitrary lossy transformations equivalent (such as the adapter's separate 4000-character cap).

### Verification
All native work used this worktree's claimed private target, jobs=2, one Cargo command at a time, under the admitted runner overlap. No `cargo fmt` and no unrelated test-only fixes.

- Native baseline: **25 tests, 15 passed / 10 failed**, nextest exit100. Includes the exact negative control returning `C:\Users\x\My` instead of the full quoted Windows path.
- Same battery after fixes: **25/25 passed**.
- Final gate-fixup battery: **47/47 passed**, 2429 outside-filter skips, exit0:
  ```text
  cargo nextest run --locked -p spt-store -p spt-daemon -p spt --lib --bin spt --no-fail-fast -j 2 -E "test(helperline::tests::) | test(inputreceipt::tests::) | test(api::nowsignal::tests::)"
  ```
- Built actual `spt.exe` and `xtask.exe`. Private-home CLI smoke: first poll emits two distinct commands in source order despite duplicate records; immediate same-session poll emits nothing; a new session sees the commands again. This is renderer/delta proof, **not owner/rc field acceptance**. Final smoke used the home-specific daemon stop inhibit. An initial smoke's private-home broker/brain were birth/exe/home-verified and reaped; final candidate-process census was empty and temporary homes were removed.
- `cargo clippy --workspace --locked -j 2`: exit0.
- `traceable-reqs check`: **932 complete, 0 incomplete, 0 findings**, exit0 after rebase (931/931 before IR-144).
- Own fresh `xtask gen` and `xtask check`: exit0. Equivalent generated CLI-reference churn excluded; only the generated changelog is included.
- Pool released Cargo-free; target retained for the gate. No disk-reclamation claim.

The actual CLI smoke exercised the dirty runtime source before the original commit. Production logic did not change during rebase or the test/doc-only gate fixup. Smoke binary SHA256: `f5c22e23d411edad49e5494b783f542bc2a815dcf40d7f3c0f5df9d8eed41fb9`; this is not a claim that the binary was built from the final commit. Tests, workspace clippy and traceability were rerun successfully for the gate fixup.

Local evidence: `.spt/preserved/318/todlando-w1/` — `red.log/json`, `final-tests.log/json`, `final-build.log/json`, `smoke.json`, `smoke-teardown.json`, `clippy.log/json`, `trace.log/json`, `post-rebase-trace.log`, `gen.log/json`, `docs-check.log/json`, `pool-release.log/json`, `runtime-identities.json`, `duplicate-record-rca.txt`. Consumed throwaway scripts/proposals were removed; receipts remain. Hertz owns independent two-node field acceptance.

Gate-fixup receipts: `fixup-{claim,tests,clippy,trace,release}.{log,json}` in the same evidence directory. Pool released. W2 is authorized to proceed immediately stacked on W1, then rebase onto main after W1 lands.