docs: record send sent diagnostic intake

docs/current-status-card.md

@@ -59,7 +59,7 @@ N13/N14/N15 are pre-business validation results. They can help identify UI eleme
 
 ## Current loop
 
-Current loop: `R10 receive-file download resolver v2 diagnostic complete`; next R11 receive-file download preview contract.
+Current loop: `R10a returned send-sent record diagnostic intake complete`; next R11 receive-file download preview contract.
 
 Active continuous execution plan: `docs/superpowers/plans/2026-07-10-r6f-r14-continuous-execution-plan.md`.
 
@@ -240,7 +240,7 @@ Continuous execution plan R6f-R14 is approved and execution has started:
 - Plan file: `docs/superpowers/plans/2026-07-10-r6f-r14-continuous-execution-plan.md`.
 - Scope: 15 ordered rounds covering send-message connector/gate hardening, send-file preview/idempotency/package, receive-file download preview, receive-message reconciliation, end-to-end business smoke, and release-candidate report.
 - Execution rule after approval: one round at a time, status-card update, verification, commit, push, then continue automatically until an evidence-only blocker requires user action.
-- Last completed round: R10 receive-file download resolver v2 diagnostic.
+- Last completed round: R10a returned send-sent record diagnostic intake.
 - Next active round: R11 receive-file download preview contract.
 
 R6g send audit and idempotency replay diagnostics is complete:
@@ -334,4 +334,13 @@ R10 receive-file download resolver v2 diagnostic is complete:
 - Fixture result: `records_checked=3`, `cache_candidates_checked=4`, `accepted_matches=2`, `ambiguous_matches=0`, `score_100_matches=1`, `score_80_matches=1`, and `score_40_only_matches=1`.
 - Diagnostic output keeps `raw_paths_printed=false`, `file_contents_read=false`, and `file_paths_returned=false`.
 - Decision: resolver logic is proven, but real production file download remains blocked until a real cache mapping package produces accepted non-ambiguous matches.
+- Next node: R10a returned send-sent record diagnostic intake, because two new operator packages arrived.
+
+R10a returned send-sent record diagnostic intake is complete:
+
+- Added `scripts\validate-send-sent-record-diagnostic-package.ps1` and `scripts\test-validate-send-sent-record-diagnostic-package.ps1`.
+- Reviewed `send-sent-record-diagnostic-package1(1).zip` and `send-sent-record-diagnostic-package2(1).zip` from Downloads using safe summary output only.
+- Both packages report `operator_observed_success=true`, `do_not_send_second_time_confirmed=true`, and `content_sha256_matches_input=true`.
+- Both packages also report `exact_content_seen_after=false`, `content_sha256_seen_after=false`, `after_offline_blocked=true`, `strict_send_record_pass=false`, and `production_send_unlock_recommended=false`.
+- Decision: production `isphere_send_message` remains blocked; the packages are useful manual evidence but not enough to open the send gate.
 - Next node: R11 receive-file download preview contract.

docs/source-discovery/2026-07-10-returned-send-sent-record-diagnostic.md

@@ -0,0 +1,55 @@
+# Returned send-sent record diagnostic intake - 2026-07-10
+
+## Inputs reviewed
+
+- `send-sent-record-diagnostic-package1(1).zip`
+- `send-sent-record-diagnostic-package2(1).zip`
+
+The raw packages stay outside the repository. This note records only safe summary fields.
+
+## Validator
+
+Added `scripts/validate-send-sent-record-diagnostic-package.ps1` for this package family. It outputs booleans and counts only; it does not print raw target id, raw message body, raw idempotency key, or local operator paths.
+
+## Safe validation summaries
+
+Package 1:
+
+```json
+{"ok":true,"package_type":"send-sent-record-diagnostic","package_file_name":"send-sent-record-diagnostic-package1(1).zip","summary_json_present":false,"input_json_present":true,"content_sha256_matches_input":true,"before_run_count":1,"after_run_count":1,"exact_content_seen_after":false,"content_sha256_seen_after":false,"after_offline_blocked":true,"operator_observed_success":true,"do_not_send_second_time_confirmed":true,"production_send_enabled":false,"automatic_send_enabled":false,"strict_send_record_pass":false,"production_send_unlock_recommended":false,"decision":"manual_success_without_machine_sent_record"}
+```
+
+Package 2:
+
+```json
+{"ok":true,"package_type":"send-sent-record-diagnostic","package_file_name":"send-sent-record-diagnostic-package2(1).zip","summary_json_present":true,"input_json_present":true,"content_sha256_matches_input":true,"before_run_count":1,"after_run_count":1,"exact_content_seen_after":false,"content_sha256_seen_after":false,"after_offline_blocked":true,"latest_after_route_hints":["A_ROUTE_INCOMPLETE","A_ROUTE_OFFLINE_BLOCKED"],"operator_observed_success":true,"do_not_send_second_time_confirmed":true,"production_send_enabled":false,"automatic_send_enabled":false,"strict_send_record_pass":false,"production_send_unlock_recommended":false,"decision":"manual_success_without_machine_sent_record"}
+```
+
+Strict mode was also checked against package 2 and failed, as expected, because `strict_send_record_pass=false`.
+
+## Business interpretation
+
+The two packages improve confidence that a human operator successfully sent the fixed sandbox message once. They do not prove that the bridge can safely enable production send, because the machine-verifiable sent-record evidence is still missing:
+
+- `exact_content_seen_after=false`
+- `content_sha256_seen_after=false`
+- `after_offline_blocked=true`
+- package 2 after route hints include `A_ROUTE_INCOMPLETE` and `A_ROUTE_OFFLINE_BLOCKED`
+
+## Decision
+
+Production `isphere_send_message` remains blocked. Current usable state remains:
+
+- send-message preview/dry-run: usable
+- audit and idempotency: usable
+- production send: blocked by missing strict machine sent-record evidence
+
+## Next requirement for unlocking production send
+
+A future online package must show all of the following without printing raw body/target/path values:
+
+1. before and after recorder outputs are present;
+2. content hash or sent-record marker is visible after send;
+3. offline blocker is absent after send;
+4. operator confirms only one send was performed;
+5. strict validator returns `strict_send_record_pass=true` and `production_send_unlock_recommended=true`.

docs/superpowers/plans/2026-07-10-r6f-r14-continuous-execution-plan.md

@@ -752,6 +752,41 @@ git push gitea main
 
 ---
 
+### R10a: Returned send-sent record diagnostic intake
+
+**Purpose:** 用户在 R10 后提供了两个 `send-sent-record-diagnostic` 返回包。本插入轮次只做安全复核：判断是否能打开生产发消息门禁；不能则记录明确阻断。
+
+**Files:**
+- Create: `scripts/validate-send-sent-record-diagnostic-package.ps1`
+- Create: `scripts/test-validate-send-sent-record-diagnostic-package.ps1`
+- Create: `docs/source-discovery/2026-07-10-returned-send-sent-record-diagnostic.md`
+- Modify: `docs/current-status-card.md`
+
+- [x] **Step 1: Write validator test first**
+
+Test covers a blocked fixture and a strict-pass fixture. Initial run failed before the validator existed.
+
+- [x] **Step 2: Implement safe validator**
+
+Validator accepts `-ZipPath`, emits booleans/counts only, and supports `-Strict` non-zero exit when strict sent-record evidence is missing.
+
+- [x] **Step 3: Validate returned packages**
+
+Both returned packages produced `decision="manual_success_without_machine_sent_record"` and `strict_send_record_pass=false`.
+
+- [x] **Step 4: Document decision**
+
+Created `docs/source-discovery/2026-07-10-returned-send-sent-record-diagnostic.md`. Production send remains blocked.
+
+**R10a Result:**
+
+- Package 1 and package 2 both have before/after runs and operator success.
+- Neither package has machine-verifiable after sent-record/content-hash evidence.
+- Both show `after_offline_blocked=true`.
+- `production_send_unlock_recommended=false`; default `isphere_send_message` remains production-blocked.
+
+---
+
 ### R11: Receive-file download preview contract
 
 **Purpose:** 即使真实下载还不能做，也让 `isphere_receive_files` 对 download 请求返回可机器解析的 preview/blocked 结果，而不是只有泛化拒绝。