GLMCHAT V2.2.1 — VERIFICATION AGAINST DOCUMENTATION
Generated: 22 July 2026 18:33:02 UTC
Input: GLMCHAT_V2.2.1_FINAL_AUDIT_HANDOVER_22072026181736.zip
Input SHA-256: e89711400e62424e11e10cd18142a201c5ce584fa7843de1442200abf3ae15db
Verification type: Fresh extraction, documentation-to-source mapping, independent toolchain rerun and package comparison
Verdict: NO-GO FOR PRODUCTION

DOCUMENTATION BASIS
The bundle does not contain one standalone build-specification file. The controlling requirements are distributed across:
- documentation/reference/FEATURE_AND_FUNCTION_MAP.txt
- documentation/reference/ROUTE_TO_UI_MATRIX.md
- documentation/reference/USER_GUIDE_22072026124256.md
- documentation/reference/ADMIN_OPERATIONS_GUIDE_22072026124256.md
- documentation/reference/INSTALLATION_AND_ACCEPTANCE_GUIDE_22072026124256.md
- documentation/current/PRODUCTION_ACCEPTANCE_CHECKLIST_22072026174417.txt
- documentation/current/FINAL_CODE_AND_BUILD_SPEC_AUDIT_22072026181634.txt

EXECUTIVE RESULT
The latest final audit is verified against the shipped source and documentation. Its seven implementation findings are valid and are not false positives. The application has a coherent architecture and the supplied build and structural checks pass, but three P0 defects contradict documented privacy, security and offline-idempotency guarantees. Three P1 functional defects and one P2 diagnostics defect are also confirmed. Required live-host, provider, real-data and physical-device acceptance remains uncompleted.

REQUIREMENT COMPLIANCE MATRIX
1. Architecture and deterministic source workspace: PASS.
   Evidence: six reconstructed frontend modules build to the deployed 180645-byte bundle with SHA-256 819dc1ca9010dbc0d7923d6d12a81fc14988cf37950d19360d19234617aad33f. PHP 8.2+/SQLite/LiteSpeed architecture and 13 migrations remain present.

2. Build, type-check, lint and portable tests: PASS, but incomplete as specification evidence.
   Evidence: build, TypeScript compatibility check, lint, 34 PHP static contracts, 7 Node tests, migration contracts and isolated HTTP preflight all pass. The tests do not cover the seven confirmed defects.

3. Core routes and UI surface: STRUCTURAL PASS.
   Evidence: 38 literal API route roots, dynamic resource routes, 19 exported screens and the documented agent/team/workflow/tool/project/chat surfaces are present. Live inference and complete browser journeys were not executed.

4. Privacy export, delete-all and reset: FAIL — AUD-P0-001 confirmed.
   Documentation/UI claim: privacy export includes definitions and the product supports full reset.
   Source evidence:
   - createExport() exports 10 datasets only.
   - The 29-table schema contains user-associated tables omitted from export, including automation_definitions, automation_templates, workflow_snapshots, workflow_workers, workflow_events, workflow_checkpoints, tool_calls, tool_approvals, workflow_interventions and message_attachments.
   - deleteAllContent() deletes 15 tables but leaves automation_definitions, automation_templates and multiple execution/approval tables.
   - resetApplication() first performs irreversible content deletion and then separately deletes users, settings and secrets; a second-phase failure cannot restore already deleted content.
   Consequence: export is incomplete, delete/reset can retain previous-owner definitions, and reset is not atomic.

5. Recent-PIN protection: FAIL — AUD-P0-002 confirmed.
   Documentation claim: recent PIN protects sensitive/destructive operations.
   Source evidence:
   - Auth::login() applies RateLimiter scope login.
   - Auth::verifyCurrentPin() has no limiter.
   - /api/data/reauthenticate and /api/settings/api-key call verifyCurrentPin() directly.
   Consequence: an authenticated stolen session can make unrestricted repeated six-digit PIN guesses against reauthentication endpoints.

6. Offline mutation idempotency: FAIL — AUD-P0-003 confirmed.
   Documentation claim: ordered replay uses UUID idempotency and survives partial failure/restart.
   Source evidence:
   - Sync::apply() checks sync_mutations.
   - It then applies the entity/filesystem change.
   - It inserts the mutation ledger result only afterwards.
   Consequence: process termination after the entity change but before ledger insertion can cause a retry to conflict, return not found or fail instead of replaying the original result. The filesystem lock does not close this crash window.

7. Offline settings parity: FAIL — AUD-P1-004 confirmed.
   Source evidence:
   - The online settings route accepts model_chat, model_vision, off/auto/high/max reasoning, preserved reasoning, TTS prices, monthly limit, warning percentage and currency.
   - The offline runtime optimistically accepts and queues arbitrary settings patches.
   - Sync::updateSettings() permits a smaller allowlist and only high/max reasoning.
   Consequence: settings may appear saved offline and then fail repeatedly during replay.

8. Installed-PWA shortcuts: FAIL — AUD-P1-005 confirmed.
   Source evidence:
   - The manifest declares five shortcuts.
   - native-android.js consumes new-chat and projects before React reads the query string and dispatches glmchat-shortcut.
   - No glmchat-shortcut listener exists.
   Consequence: New chat and Projects shortcuts can open the app without performing the requested action. The other three shortcuts remain query-driven.

9. Chat Speak action: FAIL — AUD-P1-006 confirmed.
   Source evidence:
   - Chat stores voiceSeed when Speak is selected.
   - VoiceScreen is rendered without voiceSeed.
   - VoiceScreen initialises text to an empty string and never consumes a seed.
   Consequence: Speak opens an empty TTS form instead of prefilling the selected assistant response.

10. Health endpoint purity: FAIL — AUD-P2-007 confirmed.
    Source evidence: /api/health inserts or replaces settings.__health__ inside a committed transaction and never removes it.
    Consequence: a read-style health check mutates persistent data and the internal record can appear in export/settings data.

11. Service worker, manifest and static security controls: STATIC PASS WITH FUNCTIONAL EXCEPTION.
    Evidence: relative scope/start URL, standalone/light manifest, shell-only cache policy, API exclusion, controlled service-worker activation, CSP and private-path rules pass structural checks. The shortcut defect above prevents full PWA compliance.

12. Target-host/runtime acceptance: NOT MET.
    Local target-host runner result: 15 passed, 4 failed because PHP sqlite3, curl, mbstring and zip are absent. Live LiteSpeed rewrites/headers/cookies/SSE, Together text/vision/tools/TTS, real production-data migration/rollback, Android Chrome, Samsung Internet and TalkBack remain Not run.

13. Risk decisions: NOT MET.
    Formal decisions for React 16.0.0/ReactDOM 16.0.1 and the six-digit PIN/seven-day offline credential model are not present as approved acceptance evidence.

DOCUMENTATION AND PACKAGING DISCREPANCIES
DOC-001 — The latest final audit correctly reports the seven defects, but earlier files in documentation/current still state that only external items remain open. Those files are superseded but are not clearly marked obsolete.
DOC-002 — documentation/reference/DOCUMENTATION_INDEX_22072026124256.md says the complete source is not included, while this handover contains source/, scripts/, tests/, package.json and package-lock.json.
DOC-003 — documentation/reference/FINAL_VALIDATION_22072026130658.txt says build/type-check/tests could not run because package files were absent. That statement is historical and no longer describes this handover.
DOC-004 — README_NEW_CHAT_BUNDLE_22072026175253.txt says app/ is the exact expanded direct-deploy ZIP. Runtime files are exact, but app/ additionally contains two later CHANGES evidence files and an empty storage/projects directory. Excluding those non-runtime differences, all 89 deploy files match byte-for-byte.

CHECKS ACTUALLY PERFORMED
- Fresh input ZIP extraction and compressed-data integrity: Passed.
- Baseline snapshot: 173 files captured before work.
- npm run build: Passed.
- npm run type-check: Passed.
- npm run lint: Passed.
- npm test: Passed.
  - PHP static contracts: 34 passed.
  - Node tests: 7 passed.
  - Migration contracts: fresh, clone, rollback and 12-to-13 upgrade passed.
  - HTTP preflight: expected controlled 503 for missing PHP extensions passed.
- npm run verify: Passed.
- PHP syntax: 44/44 passed.
- JavaScript syntax: Passed.
- Package/PWA/security/SQLite structural validator: 281 passed.
- Target-host filesystem/runtime runner: 15 passed, 4 failed solely for missing sqlite3, curl, mbstring and zip.
- Direct-deploy compressed-data integrity: Passed.
- Direct-deploy runtime comparison: 89 files matched byte-for-byte after excluding later audit evidence files and an empty directory.
- Static documentation-to-source verification of all seven final-audit findings: Confirmed.

CHECKS NOT RUN
- Full backend success path with required PHP extensions.
- Live LiteSpeed root and nested deployment.
- Live headers, cookies, proxy/HTTPS, rewrites and SSE buffering/cancellation.
- Live Together GLM-5.2, function calling, tools, vision and TTS.
- Upgrade/failure/rollback using a private clone of actual production data.
- Long-running workflow, concurrency, lease recovery and SQLite contention.
- Physical Android Chrome, Samsung Internet, downloads, 200% text and TalkBack.

FINAL DECISION
The source agrees with the latest final audit, not with the earlier completion claims. GLMChat V2.2.1 does not meet the documented full build specification and must not be promoted to production. Repair AUD-P0-001 through AUD-P0-003 before deployment, repair AUD-P1-004 through AUD-P1-006 before claiming full feature compliance, repair AUD-P2-007, update the stale documentation records, add regression tests for every defect, and complete all external production acceptance gates.