Observed on 2026-10-11 in the original Windows development workspace. These observations describe that installation; they do not certify every command on every machine.
| Check | Result | Scope |
| --- | --- | --- |
| Portable offline regression suite | 30 tests passed, no failures/errors/skips | Isolated folder, Python `-I`, no adjacent source/assets |
| Message ZIP export before bundling | Passed | 9,740 records, zero decode errors; plaintext verified |
| Self-message before bundling | Passed | One message sent; ACK 3 and exact persisted plaintext readback |
Every CLI help path is covered by regression tests. Synthetic fixtures cover parsing, normalization/search, export contracts, recipient guarding and helper cache integrity. Not every optional or live feature was rerun from the final bundle. Default tests do not send messages, link accounts or run live probes. JavaScript fixture checks can be skipped when Node.js is absent; inspect the report.
Run `python whatsapp.py test` for portable checks, or `python -m whatsapp_suite test` for source checks. Use `--help` before explicit live operations. Test reports and export artifacts are generated locally and ignored by Git. Do not commit live test output.
Source and rebuilt portable bundle each passed 32 offline tests, including acceptance of untested version/hash combinations and recognition of the tested configuration. A portable live arithmetic probe passed on the original tested build, with successful native cleanup. No other installed Desktop version was available for a live check. The optional Frida SQLite agent's version guard is also advisory; its changed metadata/warning path has not been retested live.
## Dynamic discovery and webhook update — 2026-10-11
Both rebuilt native helpers passed eight arithmetic cases using dynamic discovery on the existing Core DLL. The offline checker discovered its vtables/function and rejected an unrelated kernel32 DLL. This establishes discovery for one known binary, not cross-version compatibility.
An installed webhook delivered a self-message via native HTTP after installer exit with exact plaintext equality. The receiver restored the listener after a normal WhatsApp restart into a new PID, and a second self-message matched in SQLite. Receipts and payloads remain in ignored local analysis files. The installer is not kept running; the HTTP receiver is required, and its optional bootstrap reinjects after app restarts.
Source and isolated portable suites passed 41 tests, including event filtering/decoding/deduplication, bounded text and stop, durable HTTP acknowledgement, duplicate delivery, failure acknowledgement, restoration ownership, direct HTTPS validation, DPAPI token roundtrip and exclusion of transport credentials from listener JavaScript. Direct JavaScript localhost fetch was blocked by connect-src; native HTTP succeeded. No live incoming message from another account or AI summarizer was tested.
Direct HTTPS delivered two further self-messages to the authenticated Node-RED endpoint. Both message IDs and plaintext SHA-256 hashes matched the send receipts. Between messages, WhatsApp restarted from PID 16340 to 20292; the per-user minute task restored the listener automatically and exited with result 0 using the DPAPI-protected configuration. No local HTTP receiver or continuous Python watcher was running. Stop, disabled ensure and reactivation without an environment token passed. Duplicate native wake messages previously overwrote a successful request; the completed-state guard fixed the observed installation failure. Windows reboot and other Desktop versions were not live tested. The Node-RED test flow routes to an unconnected summarizer link and deduplicates in memory only.
The final 212,007-byte bundle was also checked live: 313 contact rows exported, five oldest message records read with native cleanup, and Desktop search found the self-test messages. A complete ZIP contained 9,745 message rows with zero decode errors, valid ZIP CRCs and exact plaintext equality for the post-restart test message. Rebuilding unchanged inputs produced the identical SHA-256 `76c28343eb58a93c4b6251bf1981109df25daab02e3d47f2748dfaa34501e890`. The root workspace copy matches this bundle. Optional CDP/Frida/pairing research commands were not all rerun live.
REA model summary: ev_d05f0cfdcf6fe78605cbe180c38bc8154e306a9b138fd284580cefa995afe683, parent ev_6186f4a795decd53dc3dde7935f9f6dd6bb2d2bb32816e7640842d5d41010d3d. Static coverage has dynamic unknowns; listener behavior is established separately by the live self-message tests.
