# Editor and account issues

Preserve unsaved text before refreshing, signing out, switching browser profiles or restarting. Read the actual response and current account/path. Do not repeatedly Save or reset an account while the outcome is uncertain.

# Reachability and request gates

The static reader does not start an editor. Default writing bind is loopback with port 3001; external use requires an explicitly designed private proxy/access path. Allowed hosts are exact lowercased values, including port when present. Origin, when supplied, must have the same host. Do not add arbitrary hosts or remove CSRF checks because a proxy is misconfigured.

For a size failure, preserve text and measure the request. The body limit is bytes, not a page-count or character-count promise. Check Environment variables for the actual parser/default. Wrong methods are often 404, not a uniform 405. Common JSON errors have an error string, but synchronous read/initialization failures do not all pass through that helper. Editor internals maps exact success/error contracts. A server 500 is not permission to overwrite private files; inspect safe server diagnostics, ownership and free space.

# Login and cookie state

Wrong username and wrong password intentionally share one response. Confirm the installation’s users-file path and account status through a trusted administrator, not a public support paste. Secure cookie mode must match actual HTTPS; setting it does not create TLS. Restart ends in-memory sessions and resets limiter/known-address memory, so sign in again.

Only exact trusted proxy peers may supply the client-address chain. Arbitrary forwarded headers are ignored outside that trust. The chain is read from the right to the first untrusted address. Configure only actual proxies; broad trust is not a fix for rate limiting. See Security and privacy.

# Password and account validation

Password policy is not a breached-password service or MFA. Keep secrets in the approved private collection/reset path, never issue screenshots or public logs. Server hashing applies NFKC normalization; do not treat raw string differences as independent account secrets.

Some source validation/race reasons are private diagnostics behind generic 500 rather than verbatim browser responses. Login race/lock storage and unsafe complex-section preservation are examples. Use the exact handler contract before matching messages.

The account-store lock can report “The user file is locked by another process; try again”. Determine the real owner/process and storage state before retrying or deleting a lock. A damaged/invalid user file fails closed; preserve it and restore a verified private backup rather than creating a new empty account database.

# Scope and file failures

Editors cannot see another section’s filenames through the normal tree/file API; an out-of-assignment 404 is intentional. Root pages and section-root structural changes belong to admins. A hidden reader section is not a writer assignment or privacy mechanism. Use filesystem folder names for assignments, not display titles/public URLs.

Invalid file/folder name, rename request or section rename means the submitted inputs violate the current contract. Inspect the normalized name and intended operation; do not probe alternate paths to bypass scope. Rename updates account assignments for top-level sections and ends affected sessions. See File management and Sections and pages.

# Drafts and Save

Drafts are browser-local, not encrypted history, a server revision or guaranteed deletion recovery. Clearing data, private mode or quota restrictions can remove/prevent them. Ordinary Save has no revision conflict check; a recovered draft can overwrite another writer’s changes. Review both versions first. Drafts and saving explains buffer/queue/recovery behavior.

# Admin safety and stale forms

Self-disable is refused. The last enabled administrator is protected by the account store. Browser password reset supports editors only; administrator recovery requires the server command with the correct users-file setting. An administrator can revoke sessions, which may sign them out when targeting their own account.

Section metadata can return “Section changed. Reload before saving.” and site settings “Settings changed. Reload before saving.” Preserve the intended values, reload current state, compare and deliberately reapply. Do not fake the revision token. Complex frontmatter may require editing _index.md directly when the metadata form cannot preserve it safely.

# Exact structural and metadata messages

Read exact source operation before repairing. These handler reasons are short enough to name directly, but they do not bypass earlier request/role/path gates.

Section metadata validates the fields before writing. Exact module reasons:

Title must be 1 to 120 characters
Position must be an integer between -10000 and 10000
Visibility must be a boolean

At this pin these three strings do not match the handler’s safe-error prefix rule, so an HTTP metadata save normally returns generic 500 rather than exposing them verbatim. Their values still define the form/module contract. Repair the supplied title/integer/boolean, preserve source and inspect private diagnostics rather than treating every 500 as a disk problem.

Unsafe round-trip errors have these exact private reasons:

Complex frontmatter cannot be updated safely here. Edit _index.md in the editor instead.
Section metadata could not be updated safely. Edit _index.md instead.

They normally become generic 500 through this handler. Directly review _index.md and preserve unrelated keys/body. Do not bypass stale revision validation to force a form that cannot safely retain metadata.

# Internal and account-command diagnostics

These are not all normal public JSON responses. A store read/init can fail before a handler catch; an audit append error sets a storage warning without undoing the underlying action; an invalid helper filename is a maintainer/storage issue, not an invitation to upload arbitrary icons. Session construction needs positive durations, so inspect configured parser/result.

For terminal mismatch, input is not a completed account change. Re-run the intended approved account command only after confirming runtime/account, and enter the secret privately. Ctrl+C cancels hidden input. Account commands exit unsuccessfully on policy/storage error and print the reason, without printing the password. See Commands for stdin/TTY and exit boundaries.

# Verify without weakening security

Use synthetic role accounts to verify intended allowed and denied actions, current sessions and actual saved content. Never upload private user/runtime files, expose raw editor port, trust all forwarded headers or enable raw HTML to hide an error. Repair the actual configuration and retain safe diagnostics only.