GLMCHAT V2.2.1 — PRODUCTION-HOST ACCEPTANCE CONTINUATION
Completed: 29 July 2026 13:48:39 UTC
Protected baseline: GLMCHAT_V2.2.1_PROVIDER_ALIGNED_HANDOVER_29072026123942.zip

REQUESTED TASK
Proceed with production-host acceptance using the provider-aligned handover.

BASELINE AND SCOPE CONTROL
- Extracted and hashed all 193 baseline files before modification.
- Ran the complete supplied verification suite before modifying any file.
- Used disposable copies for every Apache/PHP runtime test so database, log and storage writes could not alter the protected app tree.
- No application runtime, route, schema, migration, PWA asset, service worker, manifest, storage rule or user-data behaviour was changed.

LOCALLY AVAILABLE HOST PATH
- Apache 2.4.66 with mod_rewrite, mod_headers, mod_ssl and mod_php 8.4.16.
- HTTPS was exercised with a temporary local certificate trusted only by the acceptance client.
- Domain-root and nested /glmchat/ layouts were tested separately.
- This is Apache-compatible acceptance evidence, not evidence from the intended live LiteSpeed host.

CONFIRMED PASSES — DOMAIN ROOT
- Target-host runner: 29 passed, 4 failed.
- Additional HTTP checks: 13 passed, 0 failed.
- Public shell, manifest, service worker and offline page returned expected content types.
- Private server, storage, metadata, hidden and evidence paths returned 403.
- React history fallback returned the application shell.
- Fingerprinted JavaScript used immutable long-lived caching.
- Shell/PWA metadata used no-store/no-cache controls.
- Plain HTTP was denied without constructing an untrusted-host redirect.
- CSP, HSTS, nosniff, frame denial, referrer and permissions policies were present.
- /api/status returned the documented controlled 503 ENVIRONMENT_INVALID response with no-store caching.

CONFIRMED PASSES — NESTED /glmchat/
- Target-host runner: 29 passed, 4 failed.
- Additional HTTP checks: 13 passed, 0 failed.
- All domain-root checks above also passed beneath the nested path.
- Public and private routing remained path-relative.

TOOLING DEFECT REPAIRED
The target-host runner previously accepted an "unavailable" state in its state set but required HTTP 200, while the application correctly returns HTTP 503 with error code ENVIRONMENT_INVALID when required PHP modules are absent. The runner now:
- accepts a healthy HTTP 200 status response; or
- accepts the controlled HTTP 503 ENVIRONMENT_INVALID preflight as a valid API response;
- continues to report each missing PHP extension as a failed runtime gate.
A network-free regression test covers healthy, controlled-preflight and invalid-error cases, and is wired into npm test and npm run verify.

OPEN ENVIRONMENT GATES
The current PHP build lacks:
- sqlite3
- curl
- mbstring
- zip
Package installation was attempted, but repository/DNS access did not complete. No compatible prebuilt extension modules were found locally.
Consequently, database setup, authenticated sessions, PHP integration assertions, ZIP integration, provider calls, SSE and application mutation journeys could not execute here.

BROWSER ACCEPTANCE
Not run successfully. Playwright's managed headless shell was absent; system Chromium was blocked from the local HTTPS endpoint by sandbox policy and a direct dump-DOM attempt timed out. No application file was altered. Physical Android Chrome, Samsung Internet, TalkBack and 200% text remain open.

PRODUCTION VERDICT
CONDITIONAL STAGING CANDIDATE — NO-GO FOR PRODUCTION.
This continuation closes the local Apache-compatible root/nested rewrite, private-path, HTTPS/header, cache and controlled-preflight evidence. It does not close the actual LiteSpeed, required-PHP-module, live Together, production-data or physical-device gates.