L4 0.1.0-alpha.4

L4 now deploys autonomous Servers. Each Server owns its accounts, login, client, community data and independent storage. The optional web/PWA/Telegram Shell connects directly to these Servers.

• Removed the Instance runtime, pairing, identity assertions and proxy tier. One Server needs one application Worker; there is no master Server or shared account requirement.
• A persistent UUIDv4 identifies each Server before owner setup and serves as its internal workspace ID, public routing identity and realtime/storage namespace. There is no main workspace identity.
• Added local discovery, permitted embedding, direct invitation links, local account recovery keys and a one-use S256 login handoff with signed sessions for browsers restricting embedded cookies.
• Held WebSocket connections retain their local session identity and recheck it before writes and private fanout. Logout and account recovery revoke held-socket access; another valid session of the same user remains usable.
• The Shell keeps a flat list of saved Server connections, independent sessions and deep links. Saved connections and matching emails never grant community membership; DMs remain inside their Server.
• Cloudflare installation configures Git-connected Workers Builds and pins a published immutable Server release. The Cloudflare account needs the repository integration, an eligible deployment token and Builds administrative permissions. The Server runtime does not retain installer provisioning credentials.
• Release bundle schema 2 contains Server, Shell/site, client assets and Docs. The retired Instance baseline and all previously published release artifacts remain unchanged.
• Standalone Compose runs one Server. Live files and backups use separate storage destinations.

The alpha.3 candidate was never published: its release workflow was cancelled before creating a tag or assets after the held-socket defect was reproduced. Alpha.4 includes the correction.

This transition installs fresh standalone databases. There are no running Instances to migrate; the appended migration rejects an existing Instance-bound workspace. Archived prototype databases have no upgrade path.

Validation includes 515 unit tests, type and lint checks, immutable migration validation, a two-Server runtime fixture, Chromium Shell navigation and popup login, and isolated Cloudflare Workers Builds Preview verification. Cloudflare is the primary acceptance target. Physical-device testing and native iOS/macOS packaging remain deferred; mail, inference and RealtimeKit require independent provider configuration and acceptance.