Prepare explicit Next static-export production profile

[0thernet]

Status

Draft source checkpoint for a separately opted-in Next.js production static-export profile. Public execution is still disabled. This checkpoint does not qualify a static export, a release, or a deployment.

Source boundary

• Define an exact Next 16.2.12 static-export location contract while preserving ordinary server and Edge location semantics.
• Separate the native .next origin from discovery evidence retained under a fresh attempt. A one-use, root-bound token requires successful child and process-group collection before capture.
• Copy complete byte, mode, and logical-path evidence exclusively on the same filesystem. Source identities are checked before and after capture; archive files have distinct identities. Symlinks, hard links, special entries, replacement, partial-copy reuse, and mismatched receipts fail closed.
• Open source files with O_NOFOLLOW | O_NONBLOCK and positively verify the opened file type. A deterministic real-FIFO control confirms rejection and handle collection.
• Preserve partial failed evidence. Archives cannot become delivery inputs or substitute for final physical verification.

Package version, lockfile, public exports, generated output, production UI runtime, and CSS are unchanged.

Evidence

Base: 8626e82f9aeed4de085e418e6cae4e7dc3d8e80f.
Checkpoint: 330f56537a7213aa209be01a88299c4d6484512f, tree 22605b3aad3a96bfb9141e682fd6f03f8497f07c.

Commands used Bun 1.3.14, genuine Node 24.18.1, and both required shared schedulers:

• Frozen script-disabled install: passed without manifest or lock changes.
• bun test build/next-export-profile.test.ts: four tests passed.
• bun test build/next-export-custody.test.ts: seven tests passed, including the native FIFO control.
• Unchanged build/next-process.test.ts: four tests passed, including descendant collection.
• bun run typecheck: passed after the final custody correction.
• Independent source review: passed, including the FIFO follow-up.

Earlier focused failures are retained in the task evidence: an empty assertion-message argument, an unescaped Unicode regex delimiter, and a platform-specific human-readable EBADF message. Those test plumbing errors were corrected; no acceptance rule was relaxed.

Remaining implementation and gates

1. Join the explicit profile to plans and the production adapter without changing compile-time output: "export".
2. Reject export destinations overlapping actual declared sources, state, manifests, or other protected inputs. Hold one native-root lease across distinct export destinations.
3. Complete four-signal and phase-stream custody, native TypeScript origin versus retained-storage provenance, and final independent verification of both physical passes.
4. Verify exact HTML, Flight, segment, static asset, 404, and route-owner closure. Add a distinct packed native static-export fixture while retaining existing server and Edge fixtures.
5. Coordinate generated package artifacts, then run independent KB, integration KB, aggregate, current-head CI, artifact, and native gates before readiness.

No merge or publication is requested by this draft checkpoint.

[0thernet]

Exact checkpoint 330f565: CI run 34719210936 is terminal red at committed-output parity after inventory, strict TypeScript, and canonical package build passed. The build changed only dist/build/next.js and dist/stylex-manifest.json. Generated output was deliberately deferred from this source-only draft and remains a required coordinated join; no CI or native acceptance is claimed. CodeQL passed. Local focused profile/custody/process evidence and independent review remain as recorded. The public static-export path is still disabled. No unchanged CI rerun was requested.