docs: identify msglib wrapper analysis path

docs/superpowers/plans/2026-07-09-stage-c-log-backed-receive-messages-loop.md

@@ -1925,15 +1925,15 @@ Evidence precheck result:
 - If not identifiable, record the blocker and shift to another business-read hardening node.
 - Do not add write/send/file-download behavior.
 
-- [ ] **Step 1: Inspect safe DB metadata**
+- [x] **Step 1: Inspect safe DB metadata**
 
 Use file headers, existing summaries, and committed notes only. Avoid committing raw bytes.
 
-- [ ] **Step 2: Record likely wrapper/read path**
+- [x] **Step 2: Record likely wrapper/read path**
 
 Write a source-discovery note with the decision and next implementation slice.
 
-- [ ] **Step 3: Verify and commit docs**
+- [x] **Step 3: Verify and commit docs**
 
 Run:
 
@@ -1947,6 +1947,72 @@ Expected: all exit 0. Commit exact C24 paths only and rewrite the next loop from
 
 ---
 
+## Loop C24 Result
+
+Evidence precheck result:
+
+- Three inspected `MsgLib.db` copies do not start with SQLite magic and contain no SQLite header in the first 1 MiB sample.
+- The files have high entropy and share the same non-SQLite prefix shape across iSphere and IMPP copies, so the likely issue is an encrypted/wrapped DB format rather than a random corrupt copy.
+- Archive metadata shows SQLite and DB wrapper assemblies next to the client:
+  - `System.Data.SQLite.dll`
+  - `Utilities.Lib.DBSQLite.dll`
+  - `Utilities.Lib.SQLiteInteraction.dll`
+  - `Utilities.Lib.SQLiteInteractionBase.dll`
+  - `Utilities.Lib.DBBase.dll`
+  - `Utilities.Lib.DBModel.dll`
+  - `HYHC.IMPP.DAL.dll`
+  - `RepairDatabase.exe`
+- Ignored string-only scans of extracted wrapper candidates show relevant method/table/model hints including `tblMsgGroupPersonMsg`, `ImportOldDataBase`, `GetGroupRecentMsg`, `UpdateGroupName`, `SelectMsgGroupName`, `SelectRecentGroupName`, `groupJid`, `set_MemberJid`, `set_MsgGroupName`, `set_MemberName`, and `get_naturalname`.
+- `Utilities.Lib.SQLiteInteraction.dll` exposes SQLite connection builder plus password accessors; `Utilities.Lib.DBModel.dll` exposes connection-string decryption/password configuration concepts.
+- Decision: do not read `MsgLib.db` as ordinary SQLite. The next safe route is static .NET wrapper analysis before any copied-DB read attempt.
+
+---
+
+## Loop C25: Static .NET DB wrapper analysis
+
+**Goal:** Statically inspect the extracted DB wrapper assemblies to map candidate table/model names and connection-string/password/decryption flow for future read-only `MsgLib.db` access.
+
+**Planned files:**
+- Modify: `docs/source-discovery/capability-source-matrix.md`
+- Modify: `docs/current-status-card.md`
+- Modify: `docs/superpowers/plans/2026-07-09-stage-c-log-backed-receive-messages-loop.md`
+- Optionally create a focused source-discovery note under `docs/source-discovery/`.
+- Optionally create ignored metadata under `runs/`; do not commit binaries, raw DB bytes, decrypted content, or personal values.
+
+**Planned behavior:**
+- Inspect .NET assembly metadata/IL read-only for:
+  - `HYHC.IMPP.DAL.dll`
+  - `Utilities.Lib.SQLiteInteraction.dll`
+  - `Utilities.Lib.DBModel.dll`
+  - `Utilities.Lib.DBSQLite.dll`
+  - `RepairDatabase.exe`
+- Extract only table/model/method/property names and connection/decryption flow summaries.
+- Decide whether C26 can attempt copied-DB read-only schema extraction or must stay blocked.
+- Do not execute client binaries or modify DB files.
+- Do not add write/send/file-download behavior.
+
+- [ ] **Step 1: Generate static wrapper metadata**
+
+Use read-only metadata/IL tools or string extraction. Keep output under ignored metadata.
+
+- [ ] **Step 2: Write source-discovery conclusion**
+
+Record likely tables/models and the safest next read path.
+
+- [ ] **Step 3: Verify and commit docs**
+
+Run:
+
+```powershell
+git diff --check
+go test ./...
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts/verify-go-mcp.ps1
+```
+
+Expected: all exit 0. Commit exact C25 paths only and rewrite the next loop from actual results.
+
+---
+
 ## Self-Review
 
 - Spec coverage: the plan follows the user's cyclic requirement: plan first, implement one loop at a time, update the next loop after each result, and ask only on blockers.