docs: analyze returned live probe evidence

docs/current-status-card.md

@@ -56,7 +56,7 @@ N13/N14/N15 are pre-business validation results. They can help identify UI eleme
 
 ## Current loop
 
-Current loop: `Blocked / Waiting for send-message connector evidence`.
+Current loop: `R5b returned live-probe evidence intake complete; next R6a/C31 non-mutating send connector preflight`.
 
 Plan file: `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`.
 
@@ -110,6 +110,7 @@ Current loop output so far:
 39. C39: added `internal/isphere.MsgLibMessageSource`, an injected-provider adapter that maps `msglib.ListMessages` results into the existing receive-message domain model, preserving explicit source refs and attachment metadata while leaving MCP default PacketReader behavior unchanged.
 40. C40: added tool-level explicit receive source selection: empty/`auto`/`local_readonly` still use the primary PacketReader/log-backed source, while `source_preference="msglib_readonly"` uses a configured MsgLib receive source and is rejected when not configured.
 41. C41: wired env-configured MsgLib client into both display enrichment and explicit receive selection; optional copied-DB MCP smoke now proves `source_preference="msglib_readonly"` returns sanitized count/source evidence while standard `verify-go-mcp.ps1` remains deterministic.
+42. R5b/C30-live: analyzed returned live-probe package `isphere-live-probe-20260710-121958`; confirmed one x86 `IMPlatformClient.exe` `4.1.2.6842`, live server endpoint evidence, installed B-route DLL presence, active local `MsgLib.db` path shape, and A-route UIA selectors for search/draft/send/file menu. Production send remains blocked because the probe did not prove runtime entrypoint reachability or send success/ack mapping and the captured chat panels report an offline-send blocker.
 
 ## Recompiled business roadmap
 
@@ -152,3 +153,12 @@ R5 send-message connector discovery is complete:
 - Created `docs/source-discovery/2026-07-10-send-message-connector-selection.md`.
 - No connector was selected: no bridge/API/local service, no UIA write action chain, and no network/protocol send evidence is currently validated.
 - R6 send-message implementation and R7/R8 send-file work are blocked until a connector evidence package is supplied.
+
+R5b returned live-probe evidence intake is complete:
+
+- Created `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`.
+- Runtime evidence now proves a real x86 `IMPlatformClient.exe` process, version `4.1.2.6842`, install path family, and live TCP connection.
+- The live install contains B-route candidate binaries including `IMPlatformClient.exe`, `smack.dll`, `IMPP.Interface.dll`, `IMPP.Service*.dll`, `IMPP.UI.dll`, `TcpFileTransfer.dll`, `INetwork.dll`, and `IOClientNetwork.dll`.
+- The live process did not show `IMPP.*`, `smack.dll`, or file-transfer assemblies as currently loaded modules, so B2 runtime entrypoint reachability is still unproven.
+- UIA evidence now locates main search edit `skinAlphaTxt`, chat send document `rtbSendMessage`, send button `btnSend`, and `发送文件` menu controls, but both chat captures include the offline-send message `您已处于离线状态，无法发送消息，请上线后再次尝试！`.
+- Decision: move from generic “waiting for connector evidence” to R6a/C31 non-mutating send connector preflight. Keep `isphere_send_message` and `isphere_send_file` production behavior blocked.

docs/source-discovery/2026-07-10-returned-live-probe-analysis.md

@@ -0,0 +1,173 @@
+# Returned Live Probe Analysis
+
+Date: 2026-07-10
+Node: R5b / C30 runtime evidence intake
+Evidence package: `runs/returned-live-probe/isphere-live-probe-20260710-121958/`
+Zip SHA256: `73815D5D5370D646410C95A008EB1EAAC0C189DADEF1A9ECF69C3D628A156FEE`
+Recorder: `ISphereLiveProbeRecorder` `0.2.0`, `isphere.helper.v1`, x86 process on x64 Windows
+
+## Goal
+
+Decide whether the returned logged-in-client probe unblocks the send-message/send-file connector path.
+
+The probe is read-only evidence. It does not send, click, type, upload, download, dump memory, or hook the client.
+
+## Runtime evidence
+
+| Field | Observed value |
+| --- | --- |
+| Target process | `IMPlatformClient.exe` |
+| PID count | `1` |
+| Main executable | `C:\Program Files (x86)\Impp\IMPlatformClient.exe` |
+| Client version | `4.1.2.6842` |
+| Process bitness | x86 |
+| UI framework evidence | WinForms/WPF/.NET Framework 4 plus CEF modules |
+| Loaded install modules | `IMPlatformClient.exe`, `libcef.dll`, `chrome_elf.dll`, `System.Data.SQLite.dll` |
+| Live TCP connection | `10.212.229.210:<ephemeral>` -> `25.215.214.81:10088`, `ESTABLISHED` |
+| Config endpoint evidence | `ConnSel.xml` contains `25.215.214.81:10083` |
+| Registry uninstall entry | `即时通讯 4.1.2.6839`, uninstall path under install directory |
+
+Interpretation:
+
+- B-route sidecar work must be 32-bit / x86-compatible.
+- The live client is a .NET Framework desktop process with CEF and SQLite loaded.
+- The observed version matches the previously extracted send-candidate binary family: `IMPlatformClient.exe` length `8366592`, version `4.1.2.6842`.
+- The live process did not currently load `IMPP.*`, `smack.dll`, `TcpFileTransfer.dll`, `INetwork.dll`, or `IOClientNetwork.dll` as enumerated process modules. This does not reject B route, because those assemblies are present on disk and may be loaded lazily or as managed assemblies not visible through this module view.
+
+## Installed assembly evidence
+
+The live install directory contains the B-route candidate files:
+
+| Candidate | Present in live install | Version/size evidence |
+| --- | --- | --- |
+| `IMPlatformClient.exe` | yes | version `4.1.2.6842`, length `8366592` |
+| `smack.dll` | yes | version `1.0.0.0`, length `370688` |
+| `IMPP.Interface.dll` | yes | version `1.0.0.0`, length `33792` |
+| `IMPP.ServiceBase.dll` | yes | version `1.0.0.0`, length `12800` |
+| `IMPP.Service.dll` | yes | version `1.0.0.0`, length `21504` |
+| `IMPP.Common.dll` | yes | version `1.0.0.0`, length `479744` |
+| `IMPP.Model.dll` | yes | version `1.0.0.0`, length `35328` |
+| `IMPP.UI.dll` | yes | version `14.4.13.0`, length `2401792` |
+| `IMPP.Util.dll` | yes | version `1.0.0.0`, length `10240` |
+| `TcpFileTransfer.dll` | yes | length `45056` |
+| `HYHC.IMPP.DAL.dll` | yes | version `1.0.0.0`, length `148992` |
+| `INetwork.dll` | yes | length `87552` |
+| `IOClientNetwork.dll` | yes | length `145920` |
+
+Interpretation:
+
+- Gate B2 "files present / loadable from same install family" is partially satisfied.
+- Gate B2 "runtime entrypoints reachable from logged-in client context" is not yet satisfied.
+- Next B-route probe should be `probe_send_entrypoints`: read-only reflection/metadata confirmation for `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message methods.
+
+## Local data evidence
+
+The inventory found active local state under the iSphere document profile path shape:
+
+```text
+%USERPROFILE%\Documents\iSphere\<profile>\27000000\Account\<account>\MsgLib.db
+```
+
+The latest active `MsgLib.db` candidate was updated on 2026-07-10 UTC and belongs to the same account family previously used for copied-DB sidecar verification.
+
+Interpretation:
+
+- The receive/search side remains well-supported by the existing `MsgLibReadSidecar` path.
+- This package does not include DB contents or table output, so it is not a new receive-message schema proof by itself.
+
+## UIA evidence
+
+The probe captured three `IMPlatformClient.exe` windows successfully:
+
+| Window type | Root automation id | Evidence |
+| --- | --- | --- |
+| Main window | `frmMain` | WinForms tree captured; left search edit is addressable |
+| Group chat | `frmReserveChatRoom` | receive document, send document, send button, file menu captured |
+| Direct/P2P chat | `frmP2PChat` | receive document, send document, send button, file menu captured |
+
+Important controls:
+
+| Capability | UIA evidence |
+| --- | --- |
+| Search contacts/groups | main window edit `skinAlphaTxt`, prompt `按帐号、姓名、拼音、标签查询联系人`; toolbar button `查找联系人、工作组` |
+| Read chat panel | chat document `rtbRecvMessage` |
+| Draft text | chat document `rtbSendMessage` under `ucChatSendMessageBox1` |
+| Send text | button `btnSend`, name `发送(S)` |
+| Send file | toolbar/menu item `发送文件`; child items include `发送文件`, `最近使用文件`, `最近使用文件夹`, and group-window `查看文件列表` |
+| Conversation member info | group pane shows member-count control shape |
+
+Critical blocker observed in both chat windows:
+
+```text
+您已处于离线状态，无法发送消息，请上线后再次尝试！
+```
+
+Interpretation:
+
+- A-route fallback is now much stronger than before: it can locate search, draft, send button, and file-send menu controls.
+- A-route is not yet production-safe because the captured state explicitly reports an offline send blocker.
+- The first A-route implementation slice should be non-mutating only: locate controls, report offline/disabled send state, and optionally support draft preview in a controlled sandbox later. It should not click `btnSend` yet.
+
+## Network/protocol evidence
+
+The runtime had one established TCP connection:
+
+```text
+remote=25.215.214.81:10088
+```
+
+The install config also points at:
+
+```text
+25.215.214.81:10083
+```
+
+Interpretation:
+
+- Network/protocol route has endpoint evidence, but still lacks a sent-message request/ack contract.
+- Network replay/reimplementation remains deferred behind B route and A fallback.
+
+## Connector decision
+
+This returned package changes the write-side status from "no live connector evidence" to "B/A connector evidence found, but production send remains blocked".
+
+### B route status
+
+- B1 runtime discovery: pass.
+- B2 file presence/load-family check: partial pass.
+- B2 runtime entrypoint availability: not yet proven.
+- B3 non-mutating dynamic observation: not yet done.
+- B4 dry run: not yet implemented.
+- B5 one sandbox send: not yet allowed by evidence.
+
+### A route status
+
+- Main search selector: found.
+- Chat editor selector: found.
+- Send button selector: found.
+- File-send menu selector: found.
+- Failure/offline state: found.
+- Production send: blocked until online/test-target evidence and a dry-run/idempotency/audit path exist.
+
+## Business-goal impact
+
+| Business goal | Impact from this package |
+| --- | --- |
+| Search contacts | Live UIA search box exists; existing MCP search remains DB/log-backed and already usable. |
+| Search groups | Live UIA search/group toolbar exists; existing MCP search remains DB/log-backed and already usable. |
+| Receive messages | Active `MsgLib.db` path shape confirmed; existing explicit `msglib_readonly` receive path remains the implementation route. |
+| Send messages | Connector evidence improved, but actual sending is still not complete. Next work is non-mutating B entrypoint probe and/or A offline-state preflight. |
+| Receive files | File-list metadata remains supported; download mapping is still blocked. |
+| Send files | File menu and DLLs exist, but send-file remains behind message-send connector plus upload/file-transfer dry-run evidence. |
+
+## Next node
+
+Recommended next node: **R6a / C31 non-mutating send connector preflight**.
+
+Scope:
+
+1. Add/read-only `probe_send_entrypoints` evidence using installed/extracted binaries.
+2. Confirm `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message entrypoints by metadata, not by invoking them.
+3. Add UIA preflight classification for search/edit/send/file controls plus offline-send message detection.
+4. Keep `isphere_send_message` production blocked.
+5. Update the plan only after the preflight says whether B can continue or A fallback should take over.

docs/source-discovery/2026-07-10-send-message-connector-selection.md

@@ -124,3 +124,17 @@ Because R5 did not select a connector:
 - R6 production send implementation is blocked.
 - R7/R8 send-file work is also blocked behind the send-message connector and upload/file-transfer evidence.
 - The project should pause write-side implementation and request one of the evidence packages above.
+
+## R5b update from returned live probe
+
+The later returned live-probe package is documented in `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`.
+
+It changes this R5 conclusion from “waiting for any connector evidence” to “connector evidence exists, but production send remains blocked”:
+
+- B-route runtime discovery now passes for a real x86 `IMPlatformClient.exe` `4.1.2.6842` process.
+- The live install contains the expected B-route DLL candidates.
+- A-route UIA selectors for search, draft editor, send button, and file-send menu are visible.
+- Runtime send entrypoint reachability and success/ack mapping are still unproven.
+- The captured chat windows show an offline-send blocker.
+
+The next node is therefore R6a/C31 non-mutating send connector preflight, not R6 production send.

docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md

@@ -344,14 +344,16 @@ connector_stage = "preview" | "sandbox_send" | "production"
 
 ## Next implementation loop
 
-Next node should be **C30 B-route runtime probe**:
+R5b/C30-live returned-probe intake is now complete. The live probe confirmed a running x86 `IMPlatformClient.exe` `4.1.2.6842`, installed B-route candidate DLLs, and A-route UIA controls, but it did not prove runtime send entrypoint reachability. It also observed an offline-send blocker in the captured chat windows.
+
+Next node should be **R6a/C31 non-mutating send connector preflight**:
 
 1. Use the C# WinHelper read-only op `probe_client_runtime`.
-2. Probe running `IMPlatformClient.exe` process, bitness, path, loaded modules, and installed assembly presence.
+2. Add or run `probe_send_entrypoints` against copied/installed binaries to confirm `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message candidates by metadata only.
-3. Do not send, click, type, upload, or attach hooks in this node.
+3. Add or run a UIA preflight classifier for `skinAlphaTxt`, `rtbSendMessage`, `btnSend`, `发送文件`, and offline-send message state.
-4. Write probe output to `runs/real-loggedin-lab/sidecar-probe/` if a live client is available.
+4. Do not send, click, type, upload, attach hooks, or capture network traffic in this node.
-5. Update `capability-source-matrix.md` after B1/B2 pass or fail.
+5. Update `capability-source-matrix.md` after B2/A-route preflight passes or fails.
 
 ## Current status
 
-B is selected as the primary send/file-send route. The first non-mutating runtime probe op has been added to `ISphereWinHelper` as `probe_client_runtime`; local verification passed with no target client running. The next executable work is to run that probe while the real iSphere/`IMPlatformClient.exe` client is logged in, then perform non-mutating entrypoint confirmation.
+B is selected as the primary send/file-send route. The first non-mutating runtime probe has now been run against a real logged-in environment through the returned live-probe package. B can continue only through non-mutating entrypoint confirmation; A remains the fallback and now has concrete UIA selector evidence, but production send remains blocked until dry-run/idempotency/audit and sandbox-send evidence exist.

docs/source-discovery/capability-source-matrix.md

@@ -4,6 +4,7 @@ Date: 2026-07-10
 Stage: Core business capability roadmap
 Evidence index: `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md`
 Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
+Returned live probe: `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`
 
 ## Source priority
 
@@ -22,8 +23,8 @@ Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
 | `isphere_search_contacts` | bare sender/receiver JIDs extracted from normalized log-backed messages loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `TD_Roster`, `TD_CustomEffigy`, `tblRecent`, `tblChatLevel`, `tblPersonMsg`; decrypted roster/contact stanzas from `Smark.SendReceive`; UIA helper source if display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/contacts_test.go`; `internal/tools/isphere_contacts_test.go` | C34 documents optional MsgLib contact display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core contact search complete; optional richer fields later |
 | `isphere_search_groups` | decrypted `PacketReader.ProcessPacket` `type="groupchat"` stanzas and conference/MUC JIDs loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `tblMsgGroupPersonMsg`, `TD_WorkGroupAuth`, `tblRecent`; UIA helper source if group display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/groups_test.go`; `internal/tools/isphere_groups_test.go`; C9 ignored-log scan: PacketReader 86 groupchat/86 conference hits; Smark 24 groupchat/658 conference/631 muc hits | C34 documents optional MsgLib group display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core group search complete; optional member/owner hierarchy later |
 | `isphere_receive_files` | decrypted `PacketReader.ProcessPacket` file-transfer message stanzas via `internal/isphere.ListFilesFromMessages` and `isphere_receive_files` list mode; configured PacketReader file or directory source; `zyl\importal\<hash>` cache entries remain unlinked | MsgLib `TD_ReceiveFileRecord` safe metadata through explicit copied-DB path; decrypted `Smark.SendReceive` and `SaveToDB` traces for file-reference reconciliation; future UIA/client connector for download | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#c12-file-transfer-evidence-precheck`; `docs/source-discovery/2026-07-10-file-download-mapping-precheck.md`; `docs/source-discovery/2026-07-10-file-cache-mapping-diagnostic.md` | C22 verifies safe file-list contract args; R3 confirms list metadata is available; R3b diagnostic finds 0 current cache/archive matches, so R4 remains blocked | blocked pending better cache evidence or UI/client download connector |
-| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md` | C29 route correction: previous C15/R5 block remains historical evidence; user approved B primary and A backup. Static IL evidence identifies the client-side send chain `IMPlatformClient.exe -> smack.dll`, but no runtime sidecar send is implemented yet | next: C30 B-route runtime probe, then non-mutating manual-send observation before enabling sandbox send |
+| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md` | R5b returned live probe confirms an x86 running `IMPlatformClient.exe` `4.1.2.6842`, live TCP endpoint, installed B-route DLL presence, and A-route UIA controls (`skinAlphaTxt`, `rtbSendMessage`, `btnSend`, file menu). It also shows the chat window reporting an offline-send blocker, and it does not prove runtime send entrypoint reachability or success/ack mapping. | next: R6a/C31 non-mutating send connector preflight: `probe_send_entrypoints` plus UIA offline-state/control classifier; keep production send blocked |
-| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)` | A-route fallback: constrained UI/RPA upload/send-file flow; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md` | C29 route correction: static IL evidence identifies upload-plus-file-message chain, but runtime probe and one approved sandbox file-send observation are still required | next: wait for C30/C31 message-send probe; then C32 file-send runtime/upload probe |
+| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)` | A-route fallback: constrained UI/RPA upload/send-file flow; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md` | R5b confirms `IMPP.Service*.dll`, `TcpFileTransfer.dll`, and UIA `发送文件` menu evidence in the live install/window tree, but file-send remains blocked behind message-send connector preflight plus upload/file-message dry-run evidence. | next: wait for R6a/C31 message-send preflight; then file-send runtime/upload preflight |
 
 ## Stage C entry rule
 
@@ -40,4 +41,4 @@ Start Stage C with a narrow log-backed `isphere_receive_messages` source abstrac
 
 ## Deferred source work
 
-`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. The active roadmap is `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`; next step is R3 receive-file download mapping precheck.
+`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. The active roadmap is `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`; next step is R6a/C31 non-mutating send connector preflight.

docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md

@@ -28,9 +28,9 @@
 | Search contacts | Registered MCP tool; deterministic exact-match ranking and case-insensitive de-duplication across log/JID candidates and optional copied-DB MsgLib display enrichment. | Optional richer fields such as department/title remain future enrichment, not a core search blocker. | complete for core search; optional enrichment later |
 | Search groups | Registered MCP tool; deterministic exact-match ranking and case-insensitive de-duplication across groupchat/conference candidates and optional copied-DB MsgLib display enrichment. | Optional member count, owner refs, and nested/group hierarchy remain future enrichment, not a core search blocker. | complete for core search; optional enrichment later |
 | Receive messages | PacketReader source works; copied `MsgLib.db` explicit receive works with `source_preference="msglib_readonly"`; R1 precheck says default should remain PacketReader until a future reconciliation helper is implemented. | Future reconciliation helper, source confidence scoring, pagination policy. | future receive helper after R2/R3 |
-| Send messages | Contract exists; R5 found no validated bridge/API/local, UIA, or network/protocol write connector. | Need one approved connector evidence package before R6. | blocked pending evidence |
+| Send messages | Contract exists; R5b returned live probe confirms B-route runtime environment and A-route UIA controls, but not production send. | Need non-mutating entrypoint preflight, offline-state handling, dry-run/idempotency/audit, and one approved sandbox send before production. | next R6a/C31 non-mutating connector preflight |
 | Receive files | List mode exists from message-derived file metadata; R3/R3b confirm DB file metadata exists but current cache/archive evidence does not map to local files. | R4 download is blocked until better cache evidence or a UI/client download connector is available. | blocked; continue R5 |
-| Send files | Contract exists; no validated upload/send connector. | Blocked behind send-message connector plus upload/file-transfer evidence. | blocked pending send connector |
+| Send files | Contract exists; live probe confirms file-send menu and installed file-transfer DLL candidates. | Blocked behind send-message connector plus upload/file-transfer dry-run evidence. | wait for R6a/C31, then file-send preflight |
 
 ## Node Sequence
 
@@ -337,9 +337,75 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-go-mcp.ps1
 
 ---
 
+### R5b: Returned live-probe evidence intake
+
+**Purpose:** Consume the returned `ISphereLiveProbeRecorder` package and decide whether the send connector has enough runtime evidence to move from generic blocked status to a non-mutating preflight node.
+
+**Files:**
+- Create: `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`
+- Modify: `docs/source-discovery/capability-source-matrix.md`
+- Modify: this roadmap and `docs/current-status-card.md`
+
+**Evidence checked:**
+- `probe_client_runtime.json`
+- `filesystem_inventory.json`
+- `network_inventory.json`
+- `scan_windows.json`
+- `uia/*.json`
+- `services_registry_shortcuts.json`
+
+**Acceptance gate:**
+- The note states B1/B2/A-route status separately.
+- Production `isphere_send_message` and `isphere_send_file` remain blocked unless runtime send entrypoint reachability and success/ack evidence are proven.
+- The next node is either B-route entrypoint preflight, A-route fallback preflight, or another evidence request.
+
+**R5b Result:**
+
+- Created `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`.
+- B1 runtime discovery passes: one x86 `IMPlatformClient.exe` `4.1.2.6842` process, install path family, .NET/WPF/CEF evidence, and live TCP endpoint were observed.
+- B2 file presence partially passes: live install contains `IMPlatformClient.exe`, `smack.dll`, `IMPP.Interface.dll`, `IMPP.Service*.dll`, `IMPP.UI.dll`, `TcpFileTransfer.dll`, `INetwork.dll`, and `IOClientNetwork.dll`.
+- B2 runtime entrypoint reachability remains unproven: the process module list did not show `IMPP.*`, `smack.dll`, or file-transfer assemblies as currently loaded.
+- A-route fallback evidence improved: UIA finds main search edit `skinAlphaTxt`, chat send document `rtbSendMessage`, send button `btnSend`, and `发送文件` menu controls.
+- Production send remains blocked: the chat captures explicitly show an offline-send blocker and no send success/ack or idempotency evidence.
+- Decision: next node is R6a/C31 non-mutating send connector preflight.
+
+---
+
+### R6a: Non-mutating send connector preflight
+
+**Purpose:** Prove whether B route can continue through a read-only entrypoint probe and whether A route can reliably classify search/edit/send/file controls and offline-state blockers.
+
+**Files:**
+- Modify: `native/ISphereWinHelper/*` if adding helper op `probe_send_entrypoints` or a UIA send-control classifier.
+- Modify: `internal/helperclient/*` and tests only if Go needs to call the new helper op.
+- Modify: `docs/go-csharp-helper-boundary.md`, this roadmap, `docs/current-status-card.md`, and `docs/source-discovery/capability-source-matrix.md`.
+
+**Execution policy:**
+- No message send.
+- No file upload.
+- No UI click/type.
+- No process injection/hook.
+- No network capture.
+- Reflection/metadata inspection is allowed against copied or installed binaries.
+- UIA inspection is allowed only for locating controls and reading offline/disabled state.
+
+**Acceptance gate:**
+- `probe_send_entrypoints` or equivalent metadata evidence reports availability for:
+  - `AppContextManager.SendTxtMessageByJid`;
+  - `MessageScheduling.SendChatMessage`;
+  - `com.vision.smack.Chat.SendMessage`;
+  - file-upload/file-message candidates such as `FileTransfer.FileUpload` and `OffLineFileSend`.
+- UIA preflight reports whether `skinAlphaTxt`, `rtbSendMessage`, `btnSend`, and `发送文件` controls are present and whether an offline-send blocker is visible.
+- The result chooses one next node: B-route dry-run, A-route draft-only preflight, or another live evidence request.
+
+**Stop condition:**
+- If entrypoints cannot be confirmed or the live client remains offline, do not start R6 production send.
+
+---
+
 ### R6: Send-message preview and production path
 
-**Purpose:** Implement `isphere_send_message` after R5 validates a connector.
+**Purpose:** Implement `isphere_send_message` after R6a validates a connector path and a later approved sandbox-send gate proves success/ack behavior.
 
 **Files:**
 - Create or modify: `internal/tools/isphere_send_message.go`