# Returned Live Probe Analysis

Date: 2026-07-10
Node: R5b / C30 runtime evidence intake
Evidence package: `runs/returned-live-probe/isphere-live-probe-20260710-121958/`
Zip SHA256: `73815D5D5370D646410C95A008EB1EAAC0C189DADEF1A9ECF69C3D628A156FEE`
Recorder: `ISphereLiveProbeRecorder` `0.2.0`, `isphere.helper.v1`, x86 process on x64 Windows

## Goal

Decide whether the returned logged-in-client probe unblocks the send-message/send-file connector path.

The probe is read-only evidence. It does not send, click, type, upload, download, dump memory, or hook the client.

## Runtime evidence

| Field | Observed value |
| --- | --- |
| Target process | `IMPlatformClient.exe` |
| PID count | `1` |
| Main executable | `C:\Program Files (x86)\Impp\IMPlatformClient.exe` |
| Client version | `4.1.2.6842` |
| Process bitness | x86 |
| UI framework evidence | WinForms/WPF/.NET Framework 4 plus CEF modules |
| Loaded install modules | `IMPlatformClient.exe`, `libcef.dll`, `chrome_elf.dll`, `System.Data.SQLite.dll` |
| Live TCP connection | `10.212.229.210:<ephemeral>` -> `25.215.214.81:10088`, `ESTABLISHED` |
| Config endpoint evidence | `ConnSel.xml` contains `25.215.214.81:10083` |
| Registry uninstall entry | `即时通讯 4.1.2.6839`, uninstall path under install directory |

Interpretation:

- B-route sidecar work must be 32-bit / x86-compatible.
- The live client is a .NET Framework desktop process with CEF and SQLite loaded.
- The observed version matches the previously extracted send-candidate binary family: `IMPlatformClient.exe` length `8366592`, version `4.1.2.6842`.
- The live process did not currently load `IMPP.*`, `smack.dll`, `TcpFileTransfer.dll`, `INetwork.dll`, or `IOClientNetwork.dll` as enumerated process modules. This does not reject B route, because those assemblies are present on disk and may be loaded lazily or as managed assemblies not visible through this module view.

## Installed assembly evidence

The live install directory contains the B-route candidate files:

| Candidate | Present in live install | Version/size evidence |
| --- | --- | --- |
| `IMPlatformClient.exe` | yes | version `4.1.2.6842`, length `8366592` |
| `smack.dll` | yes | version `1.0.0.0`, length `370688` |
| `IMPP.Interface.dll` | yes | version `1.0.0.0`, length `33792` |
| `IMPP.ServiceBase.dll` | yes | version `1.0.0.0`, length `12800` |
| `IMPP.Service.dll` | yes | version `1.0.0.0`, length `21504` |
| `IMPP.Common.dll` | yes | version `1.0.0.0`, length `479744` |
| `IMPP.Model.dll` | yes | version `1.0.0.0`, length `35328` |
| `IMPP.UI.dll` | yes | version `14.4.13.0`, length `2401792` |
| `IMPP.Util.dll` | yes | version `1.0.0.0`, length `10240` |
| `TcpFileTransfer.dll` | yes | length `45056` |
| `HYHC.IMPP.DAL.dll` | yes | version `1.0.0.0`, length `148992` |
| `INetwork.dll` | yes | length `87552` |
| `IOClientNetwork.dll` | yes | length `145920` |

Interpretation:

- Gate B2 "files present / loadable from same install family" is partially satisfied.
- Gate B2 "runtime entrypoints reachable from logged-in client context" is not yet satisfied.
- Next B-route probe should be `probe_send_entrypoints`: read-only reflection/metadata confirmation for `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message methods.

## Local data evidence

The inventory found active local state under the iSphere document profile path shape:

```text
%USERPROFILE%\Documents\iSphere\<profile>\27000000\Account\<account>\MsgLib.db
```

The latest active `MsgLib.db` candidate was updated on 2026-07-10 UTC and belongs to the same account family previously used for copied-DB sidecar verification.

Interpretation:

- The receive/search side remains well-supported by the existing `MsgLibReadSidecar` path.
- This package does not include DB contents or table output, so it is not a new receive-message schema proof by itself.

## UIA evidence

The probe captured three `IMPlatformClient.exe` windows successfully:

| Window type | Root automation id | Evidence |
| --- | --- | --- |
| Main window | `frmMain` | WinForms tree captured; left search edit is addressable |
| Group chat | `frmReserveChatRoom` | receive document, send document, send button, file menu captured |
| Direct/P2P chat | `frmP2PChat` | receive document, send document, send button, file menu captured |

Important controls:

| Capability | UIA evidence |
| --- | --- |
| Search contacts/groups | main window edit `skinAlphaTxt`, prompt `按帐号、姓名、拼音、标签查询联系人`; toolbar button `查找联系人、工作组` |
| Read chat panel | chat document `rtbRecvMessage` |
| Draft text | chat document `rtbSendMessage` under `ucChatSendMessageBox1` |
| Send text | button `btnSend`, name `发送(S)` |
| Send file | toolbar/menu item `发送文件`; child items include `发送文件`, `最近使用文件`, `最近使用文件夹`, and group-window `查看文件列表` |
| Conversation member info | group pane shows member-count control shape |

Critical blocker observed in both chat windows:

```text
您已处于离线状态，无法发送消息，请上线后再次尝试！
```

Interpretation:

- A-route fallback is now much stronger than before: it can locate search, draft, send button, and file-send menu controls.
- A-route is not yet production-safe because the captured state explicitly reports an offline send blocker.
- The first A-route implementation slice should be non-mutating only: locate controls, report offline/disabled send state, and optionally support draft preview in a controlled sandbox later. It should not click `btnSend` yet.

## Network/protocol evidence

The runtime had one established TCP connection:

```text
remote=25.215.214.81:10088
```

The install config also points at:

```text
25.215.214.81:10083
```

Interpretation:

- Network/protocol route has endpoint evidence, but still lacks a sent-message request/ack contract.
- Network replay/reimplementation remains deferred behind B route and A fallback.

## Connector decision

This returned package changes the write-side status from "no live connector evidence" to "B/A connector evidence found, but production send remains blocked".

### B route status

- B1 runtime discovery: pass.
- B2 file presence/load-family check: partial pass.
- B2 runtime entrypoint availability: not yet proven.
- B3 non-mutating dynamic observation: not yet done.
- B4 dry run: not yet implemented.
- B5 one sandbox send: not yet allowed by evidence.

### A route status

- Main search selector: found.
- Chat editor selector: found.
- Send button selector: found.
- File-send menu selector: found.
- Failure/offline state: found.
- Production send: blocked until online/test-target evidence and a dry-run/idempotency/audit path exist.

## Business-goal impact

| Business goal | Impact from this package |
| --- | --- |
| Search contacts | Live UIA search box exists; existing MCP search remains DB/log-backed and already usable. |
| Search groups | Live UIA search/group toolbar exists; existing MCP search remains DB/log-backed and already usable. |
| Receive messages | Active `MsgLib.db` path shape confirmed; existing explicit `msglib_readonly` receive path remains the implementation route. |
| Send messages | Connector evidence improved, but actual sending is still not complete. Next work is non-mutating B entrypoint probe and/or A offline-state preflight. |
| Receive files | File-list metadata remains supported; download mapping is still blocked. |
| Send files | File menu and DLLs exist, but send-file remains behind message-send connector plus upload/file-transfer dry-run evidence. |

## Next node

Recommended next node: **R6a / C31 non-mutating send connector preflight**.

Scope:

1. Add/read-only `probe_send_entrypoints` evidence using installed/extracted binaries.
2. Confirm `SendTxtMessageByJid`, `MessageScheduling.SendChatMessage`, `Chat.SendMessage`, and file-upload/file-message entrypoints by metadata, not by invoking them.
3. Add UIA preflight classification for search/edit/send/file controls plus offline-send message detection.
4. Keep `isphere_send_message` production blocked.
5. Update the plan only after the preflight says whether B can continue or A fallback should take over.