Allow untested Desktop versions with compatibility warnings

docs/ARCHITECTURE.md

@@ -4,7 +4,7 @@
 
 The portable launcher verifies and decompresses its embedded payload, then imports the Python package directly from the in-memory ZIP. It uses the same CLI and modules as `python -m whatsapp_suite`.
 
-For a core live operation, Python uses Windows APIs through `ctypes`. It verifies the helper DLL and supported application build, installs a temporary `WH_GETMESSAGE` hook on the Desktop UI thread, and passes a bounded JavaScript request through shared memory. The native helper locates the existing WebView object using build-specific signatures and calls its `ExecuteScriptAsync` interface. A thread message wakes the hook. Results return through the shared mapping; the hook, mapping and process handles are then released. Reports record cleanup outcomes.
+For a core live operation, Python uses Windows APIs through `ctypes`. It verifies the helper DLL, records application/WebView compatibility, installs a temporary `WH_GETMESSAGE` hook on the Desktop UI thread, and passes a bounded JavaScript request through shared memory. The native helper locates the existing WebView object using build-specific signatures and calls its `ExecuteScriptAsync` interface. A thread message wakes the hook. Results return through the shared mapping; the hook, mapping and process handles are then released. Reports record cleanup outcomes.
 
 This still uses native C++ DLLs. Python packages their bytes; it does not replace their implementation with pure Python. The C++ source is for maintenance and is unnecessary on a machine running the portable file. SHA-256 checks verify embedded asset integrity, not publisher identity or authenticity of a downloaded file.
 
@@ -14,6 +14,14 @@ Contact export reads selected public fields from the local contact table. Sendin
 
 ## Boundaries
 
-Live native operations support Desktop build `2.2639.100.0`. Updates may invalidate signatures and require new evidence and validation. Core bridge commands do not use CDP or UI automation; optional legacy commands have their own transports and dependencies. RAM readers only see loaded models. Exported message text does not include media file downloads. Password or passkey private-key extraction is not an implemented feature.
+Live native operations were tested with Desktop build `2.2639.100.0`. Other versions are attempted with a warning. The helper still uses fixed offsets and native object/method checks derived from the tested WebView DLL. A changed layout may fail discovery or cause process instability; removing the version gate does not make those offsets version-independent. Updates require new evidence and validation to be considered tested. Core bridge commands do not use CDP or UI automation; optional legacy commands have their own transports and dependencies. RAM readers only see loaded models. Exported message text does not include media file downloads. Password or passkey private-key extraction is not an implemented feature.
 
 The repository includes only maintained source, synthetic fixtures and required runtime assets. Local profiles, extracted application code, credentials, messages, contacts and research dumps are excluded.
+
+## Security mechanism classification
+
+The observed implementation uses documented Windows hook loading and WebView script execution APIs. It does not demonstrate a memory-corruption exploit, privilege escalation or a cryptographic break. It obtains the running application's existing decrypted data through that application's internal getters under the current signed-in session.
+
+However, loading a helper into another process and locating internal objects by memory layout is reverse-engineered process instrumentation. WhatsApp does not expose the internal module calls used here as a documented external automation API. Calling documented OS/WebView APIs does not establish that this overall integration is supported or intended by WhatsApp, nor is this observation a complete security audit.
+
+References: [Microsoft SetWindowsHookExW](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexw), [Microsoft WebView2 JavaScript execution](https://learn.microsoft.com/en-us/microsoft-edge/webview2/how-to/javascript).

docs/CLI.md

@@ -19,11 +19,11 @@ The bundle compresses the original modules and resources together with LZMA.
 It verifies its embedded payload and imports Python modules directly from memory.
 Only a native helper needed for a live command is materialized in a hash-verified
 cache beside the bundle. Keep the containing folder writable. Native helper
-bytes, build checks, batch sizes and message read/send paths are unchanged.
+bytes, native object checks, batch sizes and message read/send paths are unchanged.
 
 Core WebView commands use the standard library. Python 3.11+, Windows x64,
-64-bit Python and the supported WhatsApp build are still required for live
-Desktop operations. Optional legacy CDP, Frida and QR tools retain the packages
+64-bit Python are required for live Desktop operations. Other Desktop versions
+are attempted with a compatibility warning; only the recorded version was tested. Optional legacy CDP, Frida and QR tools retain the packages
 listed below. Node.js remains optional for JavaScript fixture tests.
 
 The development package below remains the editable source. Rebuild the generated
@@ -53,7 +53,7 @@ probe responses, command dispatch, and bundled DLL hashes. Node.js runs the
 JavaScript history fixtures; that test is reported as skipped if Node is absent.
 Python 3.11 or newer is required.
 
-To test an already running supported WhatsApp Desktop installation:
+To test an already running WhatsApp Desktop installation:
 
 ```powershell
 python -m whatsapp_suite test --live
@@ -66,11 +66,12 @@ python -m whatsapp_suite contacts-export --output exports/contacts.json
 python -m whatsapp_suite send-self
 ```
 
-Live WebView probes require Windows x64, 64-bit Python, Desktop build
-`2.2639.100.0`, and the verified WebView2 Core DLL. They use bundled native
-helpers and check the build before installing a temporary hook. A missing or
-unsupported app produces a failed live result. The JSON report includes cleanup
-status. `--pid` selects a particular Desktop host.
+Live WebView probes require Windows x64 and 64-bit Python. Desktop build
+`2.2639.100.0` and its recorded WebView2 Core DLL were tested. Other versions or
+DLL hashes produce a warning and are attempted. The helper still checks native
+object signatures and methods before executing JavaScript; changed layouts can
+cause failure or process instability. The JSON report includes detected/tested
+compatibility metadata and cleanup status. `--pid` selects a Desktop host.
 
 ## Tools
 

docs/PUBLISHING.md

@@ -14,4 +14,4 @@ git push -u origin main
 
 The owner and remote URL were supplied by Karl. Repository visibility is controlled on the server. Never push the surrounding research workspace.
 
-For a release, rebuild and test the bundle, then attach only `whatsapp.py` and a SHA-256 checksum to a server release. State the supported Desktop build and optional dependencies. Do not attach test exports or research reports. No server-specific CI workflow is included because runner availability and configuration have not been verified.
+For a release, rebuild and test the bundle, then attach only `whatsapp.py` and a SHA-256 checksum to a server release. State the tested Desktop build and optional dependencies. Do not attach test exports or research reports. No server-specific CI workflow is included because runner availability and configuration have not been verified.

docs/VALIDATION.md

@@ -15,3 +15,7 @@ Observed on 2026-10-11 in the original Windows development workspace. These obse
 Every CLI help path is covered by regression tests. Synthetic fixtures cover parsing, normalization/search, export contracts, recipient guarding and helper cache integrity. Not every optional or live feature was rerun from the final bundle. Default tests do not send messages, link accounts or run live probes. JavaScript fixture checks can be skipped when Node.js is absent; inspect the report.
 
 Run `python whatsapp.py test` for portable checks, or `python -m whatsapp_suite test` for source checks. Use `--help` before explicit live operations. Test reports and export artifacts are generated locally and ignored by Git. Do not commit live test output.
+
+## Advisory compatibility update — 2026-10-11
+
+Source and rebuilt portable bundle each passed 32 offline tests, including acceptance of untested version/hash combinations and recognition of the tested configuration. A portable live arithmetic probe passed on the original tested build, with successful native cleanup. No other installed Desktop version was available for a live check. The optional Frida SQLite agent's version guard is also advisory; its changed metadata/warning path has not been retested live.

docs/runtime-assets.json

@@ -3,6 +3,6 @@
   "sha256": {
     "math_probe.dll": "136620d96f4745a4c41edfe1f4a9272ef25fc060ddace1c0eec1027bf252e02a",
     "search_probe.dll": "911beb9f6bb52390cde8a75562ca1d6c46f4629f641426a5250286903de60895",
-    "sqlite_inject.js": "f31f31e170d30c0c845a3759db631d084b0bb096f1b654a9d9168a1078daed3f"
+    "sqlite_inject.js": "61a5d8a9365353ee19ba82d95ded364331e7e69f6705b470c910d6560a22397a"
   }
 }