[Exzentttt]

Upgrade Next.js to 16.4.1 and prevent duplicate profile requests during authenticated server-rendered hydration. Addresses GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw. Fixes #304.

Next.js, its environment package and eight SWC packages stay coherent at 16.4.1; exactly eleven lock entries change including the root declaration. All other packages, Sharp 0.35.5 and the existing lint configuration are preserved. Header starts a profile request only when the captured session generation matches the render that owns the effect. Actual session changes and unmounts still cancel stale work, and stale 401 protection remains.

New English/Russian regressions render the actual Header and auth store on the server, then hydrate a persisted authenticated session. Before the fix, both cases observed an aborted request followed by another request; after the fix, one request completes and authenticated navigation appears without hydration errors.

Validation: 102 focused Header/auth/locale tests, all 1,025 frontend tests, type checking, lint (two unchanged warnings) and production build passed. Independent review approved the one-line production guard and the runtime-only dependency scope. Exact source 0174c9d3bdb5f3e47a62d47c5a6ed3af3d6c67e4; frontend tree 804be332dfc8825074a1a1b81800cceed3431d93.

Exact-head CI passed 5/5. The actual native Linux image passed all six functional and strict browser cases using Chromium 157.0.8103.15 and unchanged scenario/capture/drain limits. No pending requests, unexplained cancellations, request failures, page errors or relay errors remained. Temporary browser/SUT containers and their network were removed; the complete selected production baseline was preserved. All 18 screenshots and 36 selected decoded frames across six videos were reviewed without material UI findings. Synthetic QA does not establish live visitor counts or actual acquisition. Installed on production on 2026-11-04; frontend-only preservation and public agentspore.com checks passed. The Russian configured origin passed; anonymous public agentspore.ru retained its preexisting 403, so external access there remains unverified.

Prior-source local preview evidence remains available at https://github.com/AgentSpore/agentspore/releases/tag/qa-next-1b25a45bf449 (23 anonymous SHA-verified assets, source 1b25 before the Header fix). Final-source native Linux evidence: https://github.com/AgentSpore/agentspore/releases/tag/qa-next-0174c9d3bdb5-native-linux (45 anonymously SHA-verified assets). The prior carrier is not acceptance of the new source. Earlier macOS-over-SSH failures remain recorded; acceptance thresholds were not relaxed.

Primary advisories: GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw.

[Exzentttt]

Installed on production on 2026-11-04; postinstall and independent preservation verification passed at approximately 19:13 UTC.

Merged source bca16362077c1067f770886bc4c0b1c8ca16316f; frontend tree matches the tested image sha256:36e63ccc71f0277de445ae6134b8929a5efc101fc5fe09837159474ca8b00a9f. Next16.4.1/Node24.22.1/UID1001; build 01G0z6fw6krWwXuNRlygJ. Only frontend replaced; other20 containers,9 volumes,14 networks and protected binding metadata preserved. BackendCAF/worker/A4/Caddy unchanged. Rollback948 retained.

Public agentspore.com home/blog/connect and exact image returned200. Russian configured origin returned200 with Russian HTML; anonymous public agentspore.ru still returns its preexisting403, so external access there remains unverified.

Validation: CI5/5,1025 frontend tests, same-image six functional/six strict browser cases;18 screenshots and36 selected video frames reviewed. Native QA evidence:45 anonymously SHA-verified assets. Synthetic QA does not establish live traffic or reward eligibility. No real funds transferred.