Static deployment
The reader is static HTML, CSS, JavaScript, JSON, fonts and media. Serve the complete reviewed output with an HTTP host. Readers need no MarkStack process, database, npm install or editor accounts. The optional Node editor is a separate private service for writing/publishing; do not expose it just to make the reader work.
Choose the address and host
| Decision | Requirement |
|---|---|
| Root site | Empty configured path prefix |
| Subpath site | Matching template prefix and authored URLs |
| Public reader | Every output byte approved for public access |
| Private reader | External gate covering pages, resources, index |
| Remote provider | Current supported build, output, 404, cache setup |
| Your server | Correct document root, indexes, permissions and TLS |
Set siteUrl to the final public address and baseUrl to the intended path before building. Templates use the prefix; authored Markdown links/images are not automatically rewritten. Test deep reload at the actual host path. Root-relative URLs require HTTP, not direct file:// opening.
Editor account grants protect editing, not published reading. Hidden sidebar sections still generate and enter search. An obscure URL, private repository or noindex is not a reader access control. If confidentiality matters, validate the gate on direct page/resource/index requests from an unauthenticated client.
Artifact boundary
| Upload | Keep out |
|---|---|
| Home, page HTML | Private Markdown, source not intended for readers |
| Generated 404 | Users files and account hashes |
| Current search JSON | Runtime history, settings, publication state |
| Local CSS, JS, fonts | Editor, server implementation and HTML |
| Logo, media, downloads | Dependencies, checkout metadata and backups |
| Notices, manifest | Keys, environment files and service secrets |
| Host rule files | Unrelated files from shared target folders |
Default dist is generated; a custom --out needs explicit identification. Serve output itself, not its parent checkout. Review copied static assets because arbitrary intended or unintended files can become public there. A JSON/TXT/download extension does not prove a file safe.
Keep vendor resources/licenses together. Lazy diagrams and search may fail while ordinary prose looks correct. Source-build hosts need locked dependencies/Node during generation; a pre-rendered host only needs artifact bytes. Local assets describes that distinction.
Host contract
| Behavior | Check |
|---|---|
| Home/deep route | Directory index.html and expected content |
| Missing path | Custom missing page with actual 404 status |
| MIME | Correct HTML, CSS, JS, JSON, SVG and fonts |
| HTTP transport | HTTPS and intentional canonical redirects |
| Paths | Root, subpath and extension, directory handling |
| Security | Private files excluded and intended reader gate |
| Cache | Current coherent page, index, library set |
Stock builder emits 404.html but host must actually use it. A fallback to home with 200 is a soft 404, not equivalent. Unknown paths must not be rescued by a blanket single-page-app rewrite; this reader is generated multi-page content.
The pin’s generated 404 Return Home link is literal /, not automatically prefixed for a subpath. Verify it alongside other subpath behavior and document/handle the current limit in your own reviewed installation rather than claiming every link is rewritten.
MarkStack does not automatically create sitemap, robots, RSS, redirects or TLS. Reviewed static files may supply host-specific rules/assets. The official showcase includes a Cloudflare-specific old-route _redirects file; that file is site hosting content, not a universal builder redirect generator or nginx/Apache syntax.
Staging and replacement
- Record source/config/data/engine and build a new dedicated output.
- Review internal links/anchors/search targets, actual media and public bytes.
- Preview expected controls/layout and retain artifact hashes/counts.
- Confirm exact target document root or connected production source.
- Dry-run the selected copy/synchronization tool, especially removal of stale files.
- Copy/switch the complete reviewed artifact through the host’s supported process.
- Inspect provider status and actual live page/resource/index responses.
- Retain a known prior artifact and record acceptance.
Removed files can remain public if you only overlay new output. Conversely, deletion in a shared/unverified destination can destroy another site’s data. Do not give an unchecked delete-sync command as the default deployment recipe. Verify the target contains only this site’s intended output first.
Direct CLI build removes its selected output after narrow route preflight and can leave partial output after later failure. Do not build over a live web root where that gap is unacceptable. The editor publisher stages output but uses two renames, not guaranteed atomic availability. External hosts have their own deploy/cache semantics.
Cache and freshness
| Layer | Failure pattern |
|---|---|
| Browser | Old HTML or resources despite successful deploy |
| CDN | Custom rules retain stale index, redirects, assets |
| Host mapping | New bytes uploaded but wrong root, branch served |
| Artifact | Search, assets not included with new pages |
| Query version | Stable URL string does not prove changed bytes |
Stock CSS/scripts have query-version strings, not a general content-hash strategy. Inspect actual requests and bytes, fresh browser and existing context. Do not promise a CDN purge occurred merely because a new commit exists.
Cloudflare Pages has its own optimized default caching and advises avoiding unnecessary custom cache rules. Those rules can keep stale resources or bypass redirect behavior. Other hosts differ. Follow current provider documentation and verify the real deployment rather than copying one host’s settings to another.
Acceptance and return path
Open current distinctive home prose, a direct deep page, heading search, image/download, actual diagram and missing route. Inspect response status/type/TLS/redirects/cache as well as pixels at phone/desktop and both themes. A successful upload is not completion.
If the reader fails, identify artifact versus mapping/cache/host. Restore prior reviewed output using the supported host mechanism, then verify actual live result. A static reader rollback does not automatically restore source/accounts, and normally should not touch private runtime.
Use Review and release for gates and Health and diagnostics for layered diagnosis. Provider setup examples are templates, not a claim your account, DNS/TLS or production project was changed/tested.
Official hosting sources
Checked 12 October 2026: