GLMCHAT V2.2.1 — SEVEN-DEFECT REMEDIATION REPORT Completed: 22 July 2026 19:28:50 UTC Baseline: GLMCHAT_V2.2.1_DOCUMENTATION_VERIFIED_22072026183424.zip SCOPE Repair the seven defects confirmed by FINAL_CODE_AND_BUILD_SPEC_AUDIT_22072026181634.txt and VERIFICATION_AGAINST_DOCUMENTATION_22072026183302.txt, preserve all unrelated functionality and add permanent regression coverage. REMEDIATIONS 1. Privacy export, delete-all and full reset — FIXED - Export now contains settings safe for export, conversations, messages, message attachments, projects and project-file metadata, automation definitions, automation templates, workflows, stages, snapshots, workers, events, checkpoints, interventions, tool calls, tool approvals, generations, cost events, cost reservations, prompts, offline drafts, sync conflicts, tombstones and mutation receipts. - Project file content remains included in the ZIP archive. - Secrets, password hashes, encryption keys, sessions, CSRF values, login-attempt internals, logs and provider voice cache remain excluded and disclosed. - Delete-all covers all 25 content tables and preserves the administrator and setup. - Full reset covers the same content plus login attempts, credentials, administrator and settings, then reseeds the complete first-run defaults. - Project data and installation files are staged before mutation and restored on transaction or staging failure. - Database deletion is performed in one transaction. Automatic rollback failure is explicitly surfaced rather than hidden. 2. Recent-PIN brute-force protection — FIXED - Recent-PIN verification now requires an authenticated session. - Attempts are limited to five per ten minutes using a scope tied to the administrator, authenticated session and source address. - Successful verification clears only the matching reauthentication scope. - Login retains its separate lockout and no longer calls the reauthentication path. 3. Offline synchronisation idempotency — FIXED - The entity mutation and sync_mutations receipt are committed in one SQLite transaction. - Nested project operations use SQLite savepoints. - Project create, project delete, file put and file delete use recoverable filesystem journals. - Failed recovery retains its journal and returns an explicit recovery error rather than silently discarding the backup. - Replays with the same mutation ID and request hash return the recorded result; mismatched reuse remains rejected. 4. Offline settings mismatch — FIXED - A shared server Settings class defines the authoritative writable schema and validation. - Online settings and sync replay use the same normalisation and write path. - Offline validation uses the same keys, ranges, reasoning modes, date constraints, cross-limit rules and canonical model/currency/Boolean values before optimistic storage or queueing. 5. Installed-PWA shortcuts — FIXED - Native Android enhancement code no longer removes shortcut parameters before React sees them. - React handles every manifest shortcut and removes the parameter only after it has been read, preventing repeat execution on refresh. 6. Speak-to-Voice prefilling — FIXED - Speak routes to Voice with the selected assistant text. - Voice initialises and updates its text field from the seed, then clears the parent seed after consumption. 7. Health endpoint persistence — FIXED - Database rollbackOnly support performs the health write probe and always rolls it back. - The internal __health__ setting is no longer persisted or exposed through export. ADDITIONAL RELEASE-SAFETY CHANGE - The service-worker cache generation is now glmchat-v2.2.1-remediation-1 so installed PWAs can receive the repaired frontend/runtime assets through the existing controlled update process. PERMANENT REGRESSION COVERAGE - PHP static contracts: 53 checks. - Node tests: 12 checks, including shortcuts, Voice seed, settings parity, health, recent-PIN wiring and service-worker generation. - Python privacy/reset contracts: 24 export datasets and 25 content tables validated against the migrated schema, including foreign-key and integrity checks. - PHP remediation integration suite added for live SQLite/ZIP environments. It covers rollback-only health, scoped rate limiting, sync rollback/replay, filesystem journal rollback, export contents, delete-all rollback/completion and reset staging/transaction rollback/completion. VALIDATION OBSERVED - Build: Passed. - Type-check: Passed. - Lint: Passed. - PHP syntax: Passed for all 45 PHP application files and the integration test. - JavaScript syntax: Passed. - PHP static contracts: 53 passed. - Node tests: 12 passed. - Python migration contracts: Passed. - Python privacy/reset contracts: Passed. - HTTP preflight: Passed by returning the documented controlled 503 for missing modules. - Structural/PWA/security/SQLite package validation: 283 checks passed. - Deployment manifest and SBOM: regenerated from actual final runtime files and validated. - Target-host local runner: 15 passed, 4 failed solely because sqlite3, curl, mbstring and zip are unavailable in this sandbox. - PHP remediation integration suite: Not run locally; it was explicitly skipped because sqlite3 is unavailable. The test is included and executes automatically on a compliant target host. - Browser shell load: Not run successfully; sandbox Chromium did not complete and produced no DOM output. - Live LiteSpeed, Together provider, production-data migration/rollback and physical Android/TalkBack checks: Not run; required systems were unavailable. SCOPE REVIEW - No route, manifest scope, storage schema, migration, authentication model, PWA install mode or protected feature was removed. - No user data was present or modified. - All runtime changes map directly to the seven confirmed defects or delivery of their repaired assets. - No unrelated dependency upgrade, redesign or structure change was introduced. RELEASE VERDICT - Seven confirmed code defects: CLOSED. - Locally testable application checks: PASSED, except the module-dependent PHP integration suite and Chromium browser check recorded above as Not run. - Production approval: CONDITIONAL STAGING CANDIDATE pending the documented target-host, provider, real-data and physical-device acceptance gates.