docs: correct main send status and plan

docs/source-discovery/2026-07-11-a-route-open-conversation-window.md

@@ -3,6 +3,10 @@
 日期：2026-07-11
 分支：`codex/a-route-rpa-send`
 
+> 2026-07-12 校准：本文记录的是 synthetic 离线探针阶段和当时的真实窗体构造阻塞。后续已经通过
+> `scripts\open-offline-real-frmP2PChat.ps1` 在未登录/离线环境打开真实 `frmP2PChat`。
+> 当前以 `docs/source-discovery/2026-07-11-a-route-open-real-chat-window.md` 为准。
+
 ## 本轮目标
 
 用户明确当前先不要求真实发送消息，只要求“打开那个会话窗口”，用来验证数字员工是否能：
@@ -86,7 +90,7 @@ frmP2PChat(com.vision.smack.Chat chat, string pluginInfo, string extendTabJson)
 - `ConfigSystemManager.config`
 - `P2PChat.OtherJid`
 
-仍未成功打开真实窗体。当前阻塞不再是脚本能力，而是构造函数内部把窗体初始化、登录态、连接态、名册状态、消息中心事件、配置状态混在一起。IL 证据显示构造函数中直接访问：
+本节以下内容是当时的中间判断。后续 Task 7 已经补齐更多离线依赖并成功打开真实窗体，因此这里不再作为当前阻塞。它仍保留为风险索引：构造函数内部确实把窗体初始化、登录态、连接态、名册状态、消息中心事件、配置状态混在一起。IL 证据显示构造函数中直接访问：
 
 - `IMPPManager.Instance.Connection.add_OnConnectError`
 - `IMPPManager.Instance.Connection.add_OnReConnectOk`
@@ -98,7 +102,7 @@ frmP2PChat(com.vision.smack.Chat chat, string pluginInfo, string extendTabJson)
 - `IMPPManager.Instance.RosterManager.UpdateStrangerStatus`
 - `Config.BaseConfig.VisualPhoneEnable`
 
-这说明真实 `frmP2PChat` 不是独立窗口类；它要求完整登录运行态。没有服务端/登录态时继续硬构造，投入会越来越像“重建一个假客户端运行时”。
+后续解决方式不是走正常登录链路，而是建立更完整的离线依赖 harness，并在构造完成后补齐关键用户/JID/配置缓存。当前结论已变更为：真实 `frmP2PChat` 可以离线打开，但真实发送仍会被客户端离线状态阻断。
 
 ## 当前业务结论
 
@@ -111,10 +115,10 @@ frmP2PChat(com.vision.smack.Chat chat, string pluginInfo, string extendTabJson)
 - 点击结果可留本地审计 marker。
 - 全程不发真实消息、不上传真实文件。
 
-从“真实 iSphere 会话窗口”的目标看，仍需要在线登录环境或继续补完整客户端运行态。
+从“真实 iSphere 会话窗口”的目标看，后续已完成离线打开真实 `frmP2PChat`。从“真实业务发送”的目标看，仍需要在线登录环境。
 
 ## 下一步建议
 
-1. 当前分支先使用 `open-offline-chat-window-probe.ps1` 验证 RPA 识别/定位/点击效果。
-2. 在线环境拿到真实登录后的 `frmP2PChat` HWND 后，用同一套 WinHelper 选择器直接验证真实窗口。
-3. 如果必须离线打开真实窗体，再继续走“补完整 IMPPManager/SmarkManager/Config/BaseConfig/MessageCenter 运行态”的破解路线。
+1. synthetic 探针只作为回归兜底；真实窗口验证优先使用 `open-offline-real-frmP2PChat.ps1`。
+2. 把真实离线 `frmP2PChat` HWND 接入 `isphere_send_message` 的 `uia_rpa` connector，做可重复 UI 写入/点击 smoke。
+3. 在线环境拿到真实登录后的 `frmP2PChat` HWND 后，用同一套 WinHelper 选择器验证业务发送。

docs/source-discovery/2026-07-11-a-route-open-real-chat-window.md

@@ -155,11 +155,23 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\open-offline-real-fr
 - 本轮没有处理真实发送、真实上传、真实登录态。
 - `btnSendFile` 在这次真实离线 UIA dump 中没有以 `btnSendFile` automation id 暴露；后续如果 RPA 需要上传文件，需要另开节点定位真实工具栏按钮或菜单路径。
 
+## 2026-07-12 主分支状态校准
+
+该能力已经随 A-route 分支合并到 `main`。业务含义如下：
+
+- 已完成：真实离线 `frmP2PChat` 打开、UIA 识别、发送框定位、发送按钮定位。
+- 已演示：在真实离线窗口内写入文本并点击 `btnSend`，可用于验证数字员工的窗口识别、定位和点击链路。
+- 未完成：在线登录态下的真实发送、服务端 ack、接收方送达、发送记录匹配。
+- 未完成：真实文件上传/发送。当前真实 UIA dump 没有稳定暴露 `btnSendFile`，文件发送要单独做工具栏/菜单定位。
+
+因此，文档里出现的 helper `sent_message=true` 只能解释为“UI 发送动作已触发”，不能解释为“业务消息已送达”。
+
 ## 下一轮建议
 
 1. 把 A-route RPA 的窗口定位目标从 synthetic probe 切到真实 `frmP2PChat`：
    - root `automation_id=frmP2PChat`
    - send box `automation_id=rtbSendMessage`
    - send button `automation_id=btnSend`
-2. 如果弹出“企业信息获取失败”影响自动化，单独加一个非阻塞关闭弹窗步骤。
-3. 如果后续需要文件按钮，再专门分析真实工具栏图标按钮、菜单项和 `ToolStrip` 命中路径。
+2. 把真实窗口 HWND 接入 `isphere_send_message` 的 `uia_rpa` connector，形成可重复的本地 UI 动作 smoke。
+3. 在线登录环境中补一次业务发送验证：发送前后记录、content hash、ack/发送记录、idempotency 不重复发送。
+4. 如果后续需要文件按钮，再专门分析真实工具栏图标按钮、菜单项和 `ToolStrip` 命中路径。

docs/source-discovery/2026-07-11-a-route-uia-send.md

@@ -1,7 +1,7 @@
 # A-route UIA Send Implementation Note
 
 Date: 2026-07-11
-Branch: `codex/a-route-rpa-send`
+Branch: implemented on `codex/a-route-rpa-send`, merged to `main`
 
 ## Decision
 
@@ -25,6 +25,28 @@ $env:ISPHERE_SEND_UIA_BUTTON_AUTOMATION_ID = "btnSend"
 
 Then call `isphere_send_message` with `execution_mode="production"`.
 
+## Status correction after real-window work
+
+`uia_send_message` is a UI action connector. Its helper result fields such as
+`typed_text=true`, `clicked_ui=true`, and `sent_message=true` mean the editor was
+written and the send button was invoked/clicked. They do not mean the server
+accepted the message, the receiver got it, or a sent record was written.
+
+After this note was first written, the project also opened a real offline
+`frmP2PChat` window locally and confirmed:
+
+- root: `frmP2PChat`
+- editor: `rtbSendMessage`
+- send button: `btnSend`
+- receive area: `rtbRecvMessage`
+
+The real offline window still shows the client-side offline-send blocker, so it
+is useful for UI positioning and click verification, not for business delivery
+verification.
+
 ## Remaining real-environment work
 
-The local environment still cannot log in to iSphere. The code path is implemented and locally proven against synthetic UIA, but real iSphere success still needs a logged-in window handle and one real run in the online environment.
+The local environment still cannot log in to iSphere. The code path is
+implemented and locally proven against synthetic UIA plus the real offline chat
+window, but real iSphere success still needs a logged-in window handle and one
+online run with success/ack or sent-record evidence.

docs/source-discovery/capability-source-matrix.md

@@ -1,6 +1,6 @@
 # Capability Source Matrix
 
-Date: 2026-07-10
+Date: 2026-07-12
 Stage: Core business capability roadmap
 Evidence index: `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md`
 Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
@@ -14,6 +14,9 @@ File download mapping v2: `docs/source-discovery/2026-07-10-file-download-mappin
 Send-file sandbox gate: `docs/source-discovery/2026-07-10-send-file-sandbox-gate.md`
 Business goals smoke: `docs/reports/2026-07-10-business-goals-smoke.md`
 R14 release candidate: `docs/reports/2026-07-10-r6f-r14-release-candidate.md`
+Main status correction: `docs/reports/2026-07-12-main-business-status-correction.md`
+A-route UIA send: `docs/source-discovery/2026-07-11-a-route-uia-send.md`
+A-route real offline chat window: `docs/source-discovery/2026-07-11-a-route-open-real-chat-window.md`
 
 ## Source priority
 
@@ -32,8 +35,8 @@ R14 release candidate: `docs/reports/2026-07-10-r6f-r14-release-candidate.md`
 | `isphere_search_contacts` | bare sender/receiver JIDs extracted from normalized log-backed messages loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `TD_Roster`, `TD_CustomEffigy`, `tblRecent`, `tblChatLevel`, `tblPersonMsg`; decrypted roster/contact stanzas from `Smark.SendReceive`; UIA helper source if display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/contacts_test.go`; `internal/tools/isphere_contacts_test.go` | C34 documents optional MsgLib contact display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core contact search complete; optional richer fields later |
 | `isphere_search_groups` | decrypted `PacketReader.ProcessPacket` `type="groupchat"` stanzas and conference/MUC JIDs loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `tblMsgGroupPersonMsg`, `TD_WorkGroupAuth`, `tblRecent`; UIA helper source if group display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/groups_test.go`; `internal/tools/isphere_groups_test.go`; C9 ignored-log scan: PacketReader 86 groupchat/86 conference hits; Smark 24 groupchat/658 conference/631 muc hits | C34 documents optional MsgLib group display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core group search complete; optional member/owner hierarchy later |
 | `isphere_receive_files` | decrypted `PacketReader.ProcessPacket` file-transfer message stanzas via `internal/isphere.ListFilesFromMessages` and `isphere_receive_files` list mode; configured PacketReader file or directory source; `zyl\importal\<hash>` cache entries remain unlinked | MsgLib `TD_ReceiveFileRecord` safe metadata through explicit copied-DB path; decrypted `Smark.SendReceive` and `SaveToDB` traces for file-reference reconciliation; future UIA/client connector for download | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#c12-file-transfer-evidence-precheck`; `docs/source-discovery/2026-07-10-file-download-mapping-precheck.md`; `docs/source-discovery/2026-07-10-file-cache-mapping-diagnostic.md`; `docs/source-discovery/2026-07-10-file-download-mapping-v2.md`; `docs/reports/2026-07-10-business-goals-smoke.md` | C22 verifies safe file-list contract args; R10 proves resolver scoring with fixture accepted matches; R11 adds structured download preview with `blocked`/`planned` status and side-effect flags false; R13/R14 confirms list is ready but real download is still blocked. | blocked for real download pending accepted real cache mapping and copy gate; list mode is complete |
-| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path; current MCP tool exposes preview/dry-run only | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-sandbox-gate.md`; `docs/source-discovery/2026-07-10-returned-send-sandbox-analysis.md`; `docs/source-discovery/2026-07-10-returned-send-sandbox-analysis-v2.md`; `docs/source-discovery/2026-07-10-returned-send-sent-record-diagnostic.md`; `internal/tools/isphere_send_message_test.go`; `cmd/isphere-capability-smoke/main.go`; `docs/reports/2026-07-10-business-goals-smoke.md` | R6f-R6l define connector contract, audit/idempotency replay, production gate, B-route shell, strict-v2 package, and explicit production closure. R10a validates two returned sent-record packages as manual-only evidence: `operator_observed_success=true`, but `exact_content_seen_after=false`, `content_sha256_seen_after=false`, `after_offline_blocked=true`, and `production_send_unlock_recommended=false`. Preview is complete; production remains blocked. | blocked until strict machine sent-record/content-hash after evidence passes and a connector is configured |
-| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)`; current MCP tool exposes preview/dry-run only | A-route fallback: constrained UI/RPA upload/send-file flow; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-file-sandbox-gate.md`; `internal/tools/isphere_files_test.go`; `docs/reports/2026-07-10-business-goals-smoke.md` | R7 registers send-file preview as the tenth MCP tool; R8 adds audit/idempotency duplicate/conflict hardening without raw file paths/content; R9 builds and verifies the online send-file evidence package; R13/R14 confirms preview is ready and production upload remains blocked. | blocked until returned file-send package proves upload/sent evidence and an upload connector is gated |
+| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path; default MCP tool still exposes preview/dry-run unless an explicit connector mode is configured | A-route fallback is now implemented for UI action: `ISPHERE_SEND_CONNECTOR_MODE=uia_rpa` calls WinHelper `uia_send_message` against a configured HWND, writes `rtbSendMessage`, and clicks `btnSend`; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-sandbox-gate.md`; `docs/source-discovery/2026-07-10-returned-send-sandbox-analysis.md`; `docs/source-discovery/2026-07-10-returned-send-sandbox-analysis-v2.md`; `docs/source-discovery/2026-07-10-returned-send-sent-record-diagnostic.md`; `docs/source-discovery/2026-07-11-a-route-uia-send.md`; `docs/source-discovery/2026-07-11-a-route-open-real-chat-window.md`; `internal/tools/isphere_send_message_test.go`; `cmd/isphere-capability-smoke/main.go`; `docs/reports/2026-07-10-business-goals-smoke.md` | R6f-R6l define connector contract, audit/idempotency replay, production gate, B-route shell, strict-v2 package, and explicit production closure. R10a validates two returned sent-record packages as manual-only evidence. A-route adds local UI action readiness: synthetic window proof plus real offline `frmP2PChat` open/write/click target proof. Business delivery is still not verified because local runtime is offline and no success/ack or sent-record hash evidence has passed. | UI action ready when explicitly configured; business send remains blocked until online sent-record/content-hash/ack evidence passes |
+| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)`; current MCP tool exposes preview/dry-run only | A-route file fallback is not implemented yet; real offline UIA dump did not expose stable `btnSendFile`, so the next fallback slice is toolbar/menu locator discovery; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-file-sandbox-gate.md`; `docs/source-discovery/2026-07-11-a-route-open-real-chat-window.md`; `internal/tools/isphere_files_test.go`; `docs/reports/2026-07-10-business-goals-smoke.md` | R7 registers send-file preview as the tenth MCP tool; R8 adds audit/idempotency duplicate/conflict hardening without raw file paths/content; R9 builds and verifies the online send-file evidence package; R13/R14 confirms preview is ready and production upload remains blocked. A-route real-window work confirms file-button automation still needs a separate locator node. | blocked until file toolbar/menu locator is found and returned file-send package proves upload/sent evidence |
 
 ## Stage C entry rule
 
@@ -50,4 +53,4 @@ Start Stage C with a narrow log-backed `isphere_receive_messages` source abstrac
 
 ## Deferred source work
 
-`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. R6j/R6k confirm the send-message strict-v2 production gate is still not passed; R10a confirms the returned sent-record packages are manual-only evidence and do not unlock production send; R10/R11 define file-download resolver/preview behavior while keeping real copy blocked; R12 adds receive-source reconciliation without changing default routing; R13/R14 publish business-goals smoke and the release-candidate status. The active continuous execution plan `docs/superpowers/plans/2026-07-10-r6f-r14-continuous-execution-plan.md` is complete through R14; next work is evidence-driven, not local login-dependent.
+`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. R6j/R6k confirm the send-message strict-v2 production gate is still not passed; R10a confirms the returned sent-record packages are manual-only evidence and do not unlock production send; R10/R11 define file-download resolver/preview behavior while keeping real copy blocked; R12 adds receive-source reconciliation without changing default routing; R13/R14 publish business-goals smoke and the release-candidate status. A-route now proves UI write/click readiness against synthetic and real offline chat windows, but not online delivery. The active follow-up plan is `docs/superpowers/plans/2026-07-11-a-route-rpa-send.md`; next work is evidence-driven send/file verification, not local login-dependent.