GLMChat V2.2.1 — SHARED-HOSTING READY RELEASE REPORT
Generated: 2026-07-30T00:24:06Z
Baseline: GLMCHAT_V2.2.1_ROUTE_NOT_FOUND_FIXED_HANDOVER_29072026220256.zip

REQUESTED TASK
Make the route-fixed GLMChat package ready to extract and run on shared hosting.

IMPLEMENTATION
- Preserved the flat document-root deployment layout.
- Removed optional Options and DirectoryIndex directives from public and private .htaccess files because restricted shared-hosting AllowOverride policies can reject those directives with HTTP 500.
- Preserved API rewriting, React history fallback, HTTPS hand-off, security headers, private-directory denial and the index.php PWA-shell fallback.
- Added a blocked-from-HTTP shared-hosting quick-start guide.
- Documented direct extraction, hidden-file preservation, required PHP extensions, /api/status preflight, existing-storage preservation and cache clearing.
- Added a permanent regression contract for restricted shared-hosting .htaccess compatibility.
- Normalised direct-deploy ZIP metadata to directories 0755 and files 0644. The application hardens runtime private directories to 0700 and generated private files to 0600 after PHP starts.
- Regenerated DEPLOYMENT_MANIFEST.json and sbom.cdx.json from the actual final deploy tree.

VALIDATION PERFORMED
- npm run verify: Passed.
- Deterministic frontend build: Passed.
- Type-check: Passed.
- Lint: Passed.
- PHP static contracts: 70 passed.
- Node automated tests: 24 passed.
- Migration fresh/upgrade/rollback/custom-value checks: Passed.
- Privacy/reset contracts: Passed.
- HTTP preflight: Passed with controlled 503 for the four unavailable local PHP extensions.
- PHP syntax: Passed for all PHP files.
- JavaScript syntax: Passed.
- Package/PWA/security/SQLite static checks: 301 passed.
- Restricted Apache AllowOverride test, domain root: Passed.
- Restricted Apache AllowOverride test, nested /glmchat path: Passed.
- Root, index.php, history route, manifest, service worker, API routing, private-path denial and blocked quick-start HTTP access: Passed in both layouts.

NOT RUN
- Native LiteSpeed runtime on the user's actual shared host.
- Full PHP/SQLite integration suite because local PHP lacks sqlite3; archive integration also requires zip.
- Live Together API requests.
- Migration of a private clone of actual production data.
- Physical Android Chrome, Samsung Internet and TalkBack acceptance.

RELEASE DISPOSITION
The generated server-direct-deploy ZIP is ready to extract directly into an HTTPS shared-hosting document root or subdirectory. It contains no enclosing app folder. Existing installations must preserve their storage directory during replacement.