fix: 限制边缘节点仅使用 IPv4 并记录维护约定

.claude/skills/edge-node-multi-protocol/references/dns-records.md

@@ -5,14 +5,13 @@ whatever `ACME_DNS_PLUGIN` you set — acme.sh supports Cloudflare, DNSPod, Aliy
 GoDaddy, and dozens more. That part is provider-agnostic.
 
 The only thing that is *not* automated for non-Cloudflare providers is creating the host
-**A/AAAA records**. That's just two names. Create them in your DNS provider's console/API:
+**A records**. The current fleet is IPv4-only: keep `SERVER_IPV6` empty and do not create
+AAAA records. Create these two names in your DNS provider's console/API:
 
 | Name | Type | Value | Proxy/CDN |
 |---|---|---|---|
 | `<DOMAIN_ROOT>` (e.g. `nodeA.example.com`) | A | `SERVER_IP` | **off** (DNS-only / grey cloud) |
 | `*.<DOMAIN_ROOT>` | A | `SERVER_IP` | **off** |
-| `<DOMAIN_ROOT>` | AAAA | `SERVER_IPV6` | off (skip if no IPv6) |
-| `*.<DOMAIN_ROOT>` | AAAA | `SERVER_IPV6` | off |
 
 Notes:
 - Keep them **unproxied** — the node terminates its own TLS and needs the real client IP path; a proxy/CDN in front would break the WS cover and the panel anti-scan logic.
@@ -21,10 +20,14 @@ Notes:
 
 ## Cloudflare shortcut
 
-If your zone is on Cloudflare, skip the manual step — `02-cf-dns.py` upserts all four
-records for you via the API (`CF_API_TOKEN` with `Zone:DNS:Edit`). Run it from wherever the
+If your zone is on Cloudflare, skip the manual step — `02-cf-dns.py` upserts the two A
+records when `SERVER_IPV6` is empty (`CF_API_TOKEN` with `Zone:DNS:Edit`). Run it from wherever the
 token lives; it never touches the VPS.
 
+Leaving `SERVER_IPV6` empty does **not** delete existing AAAA records. For an existing
+node, back up DNS records, remove the AAAA records under that node's domain, then check
+the API and public DNS. See [IPv4-only fleet policy](../../../../docs/EDGE-IPV4-ONLY.md).
+
 ## Picking the acme.sh plugin + creds
 
 Set `ACME_DNS_PLUGIN` and the matching credential vars in `config.env` (acme.sh reads them