L4 0.2.6

Server installation and identity are rebuilt around one UUID. A Server now installs and updates with only a Cloudflare account, serves several addresses, keeps its settings in D1, and PR verification uses native Worker Previews.

• Install a Cloudflare Server with only a Cloudflare account: no Git, GitHub, repository integration, Workers Builds permission or deployment token. The official /create installer uploads a published, checksum-verified release through the customer's browser-bound OAuth grant, and the Server keeps no account-wide credential after installation or update.
• Update through the official installer: Settings → Deployment → Updates saves one local request with a one-job backup capability and returns a launch URL that carries no credential. Before any upload the installer verifies the persisted backup archive (SHA-256, tar headers, entry sizes, inventory and R2 metadata/payload pairing) and compares live D1 table/row counts and files-bucket object/byte counts; a changed Server stops for a retry instead of deploying against a stale backup, and retries resume, including from another browser after a stale lease.
• Serve a Server on several addresses: the configured address list is authoritative for Cloudflare Servers, with PUBLIC_ORIGIN as the backward-compatible primary. Discovery, login, sessions, MCP, uploads, backups and realtime answer on the primary and every alias, and unknown hosts are rejected. Settings → Server address adds, removes and promotes Cloudflare custom domains; the /domain one-time OAuth flow attaches them while the account-wide grant stays in the site's encrypted session.
• The Shell accepts alias probes and deduplicates Servers by UUID, and the update flow verifies the updated Server through any working address. VPS installs gain llll domain list|add|remove|primary, including Caddy addresses, .env updates, rollback and health checks on every address.
• One UUID names every Server resource — Worker (llll-<uuid>), D1, files, backups and tickets KV — and seeds server_identity before first boot; VPS installs save the same UUID as SERVER_ID, and discovery and backup prefixes use it.
• Fresh Workers bind a minimal unprefixed env: PUBLIC_ORIGIN, AUTH_SECRET, AUTH_MODE (plus Access bindings when used), ACCOUNT_ID and resource bindings.
• Server settings move to D1: the pending owner claim stores only a SHA-256 token digest and its row is deleted on claim; worker name, backup bucket, mail domains/hostname/local part and registration mode live in the database, and the setup form asks for the Server name. Existing Servers migrate in place: the first update upload copies legacy env into D1 and a second metadata upload removes the legacy bindings, preserving the UUID, accounts and files. The optional Build deploy-hook path is gone; queued updates continue on the official installer.
• PR verification deploys a native Worker Preview of the one staging Server Worker instead of per-PR llll-server-pr-* Workers: Durable Object state is isolated per Preview and deleted with it, D1/R2/KV bind long-lived shared staging resources, migrations apply in the Build, and Previews inherit no vars or secrets from production. A read-only inventory script prints a concrete cleanup proposal for leftover per-PR resources.

Validation includes 725 unit tests, lint, type checks, builds, independent Server integration, self-host and local-stack checks, shellcheck, model checks and migration checks for 0000–0010. Each feature PR was verified on its deployed Cloudflare Preview, and the VPS installer and update flows ran in isolated Linux containers with the Server UUID preserved across upgrade and rollback.

This release appends the schema migrations 0009_server_origins and 0010_server_settings within the server-v1 lineage; fresh installs and in-place updates both apply them. The official site, Shell, standalone Server, portable amd64 runtime, VPS installer and version-pinned Docs share version 0.2.6. Customer Servers stay pinned until their operators select the update and complete the verified backup/update flow. Native iOS/macOS packaging remains frozen.