isphere-ai-bridge/docs/source-discovery/2026-07-10-returned-live-probe-analysis.md

Returned Live Probe Analysis

Date: 2026-07-10 Node: R5b / C30 runtime evidence intake Evidence package: runs/returned-live-probe/isphere-live-probe-20260710-121958/ Zip SHA256: 73815D5D5370D646410C95A008EB1EAAC0C189DADEF1A9ECF69C3D628A156FEE Recorder: ISphereLiveProbeRecorder 0.2.0, isphere.helper.v1, x86 process on x64 Windows

Goal

Decide whether the returned logged-in-client probe unblocks the send-message/send-file connector path.

The probe is read-only evidence. It does not send, click, type, upload, download, dump memory, or hook the client.

Runtime evidence

Field	Observed value
Target process	IMPlatformClient.exe
PID count	1
Main executable	C:\Program Files (x86)\Impp\IMPlatformClient.exe
Client version	4.1.2.6842
Process bitness	x86
UI framework evidence	WinForms/WPF/.NET Framework 4 plus CEF modules
Loaded install modules	IMPlatformClient.exe, libcef.dll, chrome_elf.dll, System.Data.SQLite.dll
Live TCP connection	10.212.229.210:<ephemeral> -> 25.215.214.81:10088, ESTABLISHED
Config endpoint evidence	ConnSel.xml contains 25.215.214.81:10083
Registry uninstall entry	即时通讯 4.1.2.6839, uninstall path under install directory

Interpretation:

• B-route sidecar work must be 32-bit / x86-compatible.
• The live client is a .NET Framework desktop process with CEF and SQLite loaded.
• The observed version matches the previously extracted send-candidate binary family: IMPlatformClient.exe length 8366592, version 4.1.2.6842.
• The live process did not currently load IMPP.*, smack.dll, TcpFileTransfer.dll, INetwork.dll, or IOClientNetwork.dll as enumerated process modules. This does not reject B route, because those assemblies are present on disk and may be loaded lazily or as managed assemblies not visible through this module view.

Installed assembly evidence

The live install directory contains the B-route candidate files:

Candidate	Present in live install	Version/size evidence
IMPlatformClient.exe	yes	version 4.1.2.6842, length 8366592
smack.dll	yes	version 1.0.0.0, length 370688
IMPP.Interface.dll	yes	version 1.0.0.0, length 33792
IMPP.ServiceBase.dll	yes	version 1.0.0.0, length 12800
IMPP.Service.dll	yes	version 1.0.0.0, length 21504
IMPP.Common.dll	yes	version 1.0.0.0, length 479744
IMPP.Model.dll	yes	version 1.0.0.0, length 35328
IMPP.UI.dll	yes	version 14.4.13.0, length 2401792
IMPP.Util.dll	yes	version 1.0.0.0, length 10240
TcpFileTransfer.dll	yes	length 45056
HYHC.IMPP.DAL.dll	yes	version 1.0.0.0, length 148992
INetwork.dll	yes	length 87552
IOClientNetwork.dll	yes	length 145920

Interpretation:

• Gate B2 "files present / loadable from same install family" is partially satisfied.
• Gate B2 "runtime entrypoints reachable from logged-in client context" is not yet satisfied.
• Next B-route probe should be probe_send_entrypoints: read-only reflection/metadata confirmation for SendTxtMessageByJid, MessageScheduling.SendChatMessage, Chat.SendMessage, and file-upload/file-message methods.

Local data evidence

The inventory found active local state under the iSphere document profile path shape:

%USERPROFILE%\Documents\iSphere\<profile>\27000000\Account\<account>\MsgLib.db

The latest active MsgLib.db candidate was updated on 2026-07-10 UTC and belongs to the same account family previously used for copied-DB sidecar verification.

Interpretation:

• The receive/search side remains well-supported by the existing MsgLibReadSidecar path.
• This package does not include DB contents or table output, so it is not a new receive-message schema proof by itself.

UIA evidence

The probe captured three IMPlatformClient.exe windows successfully:

Window type	Root automation id	Evidence
Main window	frmMain	WinForms tree captured; left search edit is addressable
Group chat	frmReserveChatRoom	receive document, send document, send button, file menu captured
Direct/P2P chat	frmP2PChat	receive document, send document, send button, file menu captured

Important controls:

Capability	UIA evidence
Search contacts/groups	main window edit skinAlphaTxt, prompt 按帐号、姓名、拼音、标签查询联系人; toolbar button 查找联系人、工作组
Read chat panel	chat document rtbRecvMessage
Draft text	chat document rtbSendMessage under ucChatSendMessageBox1
Send text	button btnSend, name 发送(S)
Send file	toolbar/menu item 发送文件; child items include 发送文件, 最近使用文件, 最近使用文件夹, and group-window 查看文件列表
Conversation member info	group pane shows member-count control shape

Critical blocker observed in both chat windows:

您已处于离线状态，无法发送消息，请上线后再次尝试！

Interpretation:

• A-route fallback is now much stronger than before: it can locate search, draft, send button, and file-send menu controls.
• A-route is not yet production-safe because the captured state explicitly reports an offline send blocker.
• The first A-route implementation slice should be non-mutating only: locate controls, report offline/disabled send state, and optionally support draft preview in a controlled sandbox later. It should not click btnSend yet.

Network/protocol evidence

The runtime had one established TCP connection:

remote=25.215.214.81:10088

The install config also points at:

25.215.214.81:10083

Interpretation:

• Network/protocol route has endpoint evidence, but still lacks a sent-message request/ack contract.
• Network replay/reimplementation remains deferred behind B route and A fallback.

Connector decision

This returned package changes the write-side status from "no live connector evidence" to "B/A connector evidence found, but production send remains blocked".

B route status

• B1 runtime discovery: pass.
• B2 file presence/load-family check: partial pass.
• B2 runtime entrypoint availability: not yet proven.
• B3 non-mutating dynamic observation: not yet done.
• B4 dry run: not yet implemented.
• B5 one sandbox send: not yet allowed by evidence.

A route status

• Main search selector: found.
• Chat editor selector: found.
• Send button selector: found.
• File-send menu selector: found.
• Failure/offline state: found.
• Production send: blocked until online/test-target evidence and a dry-run/idempotency/audit path exist.

Business-goal impact

Business goal	Impact from this package
Search contacts	Live UIA search box exists; existing MCP search remains DB/log-backed and already usable.
Search groups	Live UIA search/group toolbar exists; existing MCP search remains DB/log-backed and already usable.
Receive messages	Active MsgLib.db path shape confirmed; existing explicit msglib_readonly receive path remains the implementation route.
Send messages	Connector evidence improved, but actual sending is still not complete. Next work is non-mutating B entrypoint probe and/or A offline-state preflight.
Receive files	File-list metadata remains supported; download mapping is still blocked.
Send files	File menu and DLLs exist, but send-file remains behind message-send connector plus upload/file-transfer dry-run evidence.

Next node

Recommended next node: R6a / C31 non-mutating send connector preflight.

Scope:

1. Add/read-only probe_send_entrypoints evidence using installed/extracted binaries.
2. Confirm SendTxtMessageByJid, MessageScheduling.SendChatMessage, Chat.SendMessage, and file-upload/file-message entrypoints by metadata, not by invoking them.
3. Add UIA preflight classification for search/edit/send/file controls plus offline-send message detection.
4. Keep isphere_send_message production blocked.
5. Update the plan only after the preflight says whether B can continue or A fallback should take over.