Are you sure that it's not being passed through an xml process expanding
the character references before being served?

      CharResponseWrapper wrapper = new
            CharResponseWrapper((HttpServletResponse)response);
      chain.doFilter(request,wrapper);
      s = wrapper.toString();
      if (debug.level != null) {
        String fn = "xml" + fileNo + ".xml";
        System.out.println("XSLT: " + fn + " (" +
                           response.getCharacterEncoding() + ")");
        FileWriter fw = new FileWriter(fn);
        fileNo = (fileNo + 1) % 8;
        fw.write(s);
        fw.close();
      }
      if (s.length() > 0) {
        Transformer transformer = xslt.newTransformer();
        Source transformSource = new StreamSource(new StringReader(s));
        StreamResult result = new StreamResult(response.getWriter());
        transformer.transform(transformSource, result);
      }

I then search the file with "od -b | grep ' [4-7][0-7][0-7]'", and
there is no match. So the file contains only 7-bit ASCII (or however
you want to say it!). Meanwhile the transformed response is squirted
back to the requesting browser.

And, as I said, the same document content with a different root node
processed by the same stylesheet using the code above produces either
the correct output or garbled output. Aaargh!

Any other thoughts?
--
John English