I will wait for feedback on the latest version before updating the distributed plugin list: https://bitbucket.org/rdipardo/dbgp/src/v0.14.2/CHANGELOG.txt
This thread has already climbed the search engine rankings for Xdebug issues, so I didn’t want to leave the impression that DBGp is unmaintained.
Lesson learned: Delphi Strings are implicitly passed by reference (as if the type identifier were PChar instead). That means this method would overwrite a validly escaped file URI with the file’s literal path — spaces, backslashes, and all — which the debugger obviously can’t find. Still no luck getting UNC paths to resolve to proper URIs, but that seems to be a known issue with Xdebug itself.
Simply getting the source command to execute was only the beginning of the trouble. The message parsing code was written for an obsolete spec, when error nodes were simple text elements. Treating them as such was raising DOM exceptions that obscured real debugger errors, and calling methods on a missing node object would cause the occasional access violation. Then I found out the socket destructor would be invoked twice; once when the temporary source map was unloaded, once more when the socket closed, and the second time around it tried to look up the same unloaded file, calling a method on a member object it had already freed.
All of this came to light only after source mapping started to work, but only for local files in ideal conditions, which makes me wonder about the stability of future releases. The feature set of current versions is definitely crippled, but that also means they can’t fail too dangerously. Like the classic car it really is, DBGp is not for daily driving.