L4 0.2.8

Server installation works without R2, owner setup opens on the Server's own domain, and agent failures become visible and inspectable. Pi remains the only agent engine.

• Owner setup opens as a top-level /setup#claim=… page on the Server domain. The Client captures and removes the private fragment before navigation; the password form uses native autocomplete. The installer observes readiness and saves the Server in the Shell. Unclaimed Servers are not embedded before setup completes.
• When R2 is unavailable, the installer can use private Basic storage in the existing TICKETS KV namespace. A transactional D1 catalog reserves uploads and enforces a 20 MiB file limit and 500 MiB application quota. Basic storage shares Cloudflare's daily KV quota with connection tickets. R2 remains available for larger deployments.
• Storage settings connect R2 through a fresh browser-bound Cloudflare grant. Migration explicitly copies and verifies files before switching storage; uploads pause during copying, reads remain available and original KV objects are retained. Existing mixed storage remains readable while a migration resumes.
• Servers without a separate backup bucket download the complete backup before an update. The browser verifies its recorded digest and byte count; an interrupted or mismatched download cannot authorize deployment. Logical file backups restore without depending on the original KV namespace. Keep backups separately from live storage.
• Agent and conversation model choices take precedence over the Server default. Legacy bare IDs retain their deployment endpoint or resolve to one unambiguous enabled connection; importing OpenRouter preserves existing profile selections. Disabled or ambiguous choices produce actionable errors instead of silently using a different model.
• Failed agent admission and inference appear in the conversation and in Run details. The owner Audit links to the selected model, individual model requests, safe errors, events and transcript downloads. Only the original initiating Member can retry a stopped Run, under current authorization. Provider credentials and raw upstream errors remain private.
• Every root agent invocation opens a thread, including direct Agent conversations. Agents, human DMs and channels share nested thread navigation, selection and unread state. New queued threads appear before the first reply. Replies stay in their thread, and terminal attempts release admission claims without waiting for slow compute cleanup.
• Conversations have two forms: two-person DMs and open/private channels. Existing group DMs become private channels in place, preserving IDs, messages, threads and recorded creators. Pre-upload SQL preserves the old conversation types; conversion runs only when the new Worker activates, so a failed code upload leaves the previous Worker's groups intact.
• Only a private channel's creator can add or remove participants. For older channels without a recorded creator, the Server owner can explicitly choose a current human participant in Settings → Channels. Assignment and its audit record commit together; the owner gains no membership or message access. Task discussions and Mailbox access keep their own rules.
• Adding a participant grants the channel's full history and marks that prior history as read. New messages after the access grant remain unread. Membership changes preserve the conversation's identity and history.
• Think runtime code, bindings and dependencies are retired; Agents use Pi/pi-durable. OpenCode and OpenCode Go provider options and transport are removed. Operators using those connections must select another configured provider. OpenRouter, Claude API and ChatGPT connections remain available; no free inference default is promised.
• Initial Client loading and embedded Server loading offer recovery controls. Timestamp tooltips use the viewer's timezone. Local Shell preparation and password-claim navigation are corrected.

Validation for the combined changes includes 845 tests across 151 unit/component files, root and client type checks, lint, migration/domain checks, builds, isolated Pi execution, R2 and KV Server integration, self-host installation/cold restore and local-stack recovery. All 19 GitHub/Workers Builds checks passed on the feature PR, and its Web Preview matched the exact tested commit. The in-app browser exercised creator recovery and its Audit record on synthetic data. Fresh-account Cloudflare R2/TLS provisioning, browser password-manager suggestions, live subscription inference and a deployed Cloudflare Server Preview remain separate acceptance gaps.

This release appends migrations 0012–0013 within server-v1. Cloudflare removes the retired Think Durable Object class; celld retains historical class metadata because its current deployment API does not support class deletion. Keep a verified pre-update backup. The official web, Shell, installer, standalone Server, portable amd64 runtime and version-pinned Docs share version 0.2.8. Customer Servers remain pinned until their operators complete the backup/update flow. Native iOS/macOS publication remains frozen.