# Security and history

Admin’s System areas show Security, Activity and Publishes. They inspect the actual private editor server, not a remote reader host. Security is read-only policy reporting plus your own password form; Activity is bounded local history; Publishes combines recorded outcomes with current publisher state.

# Areas and page sizes

These are different views over local state. Activity’s initial 50does not mean publish history initially 50. An absent record is not proof an operation never happened: rotation, write failures, wrong runtime and pre-history operations can limit evidence.

# Security display

Reload refreshes the current summary. It does not alter thresholds, clear a limiter, enable TLS, change trusted proxies or configure reader access. Secure-cookie configuration describes what cookies require, not proof the public connection actually has valid TLS.

A summary without warning is not a full security assessment. Compare the actual host/listener/proxy/cookie/session settings with your deployment and test denied paths. The raw HTML setting concerns editor preview; build-time Markdown rendering is a separate configuration path.

All default windows and pauses are 15 minutes.

The implementation counts within a window beginning with the first tracked failure, not a continuously sliding window of every attempt. A threshold starts a block from that failure. Successful login clears its account/address pair; it does not clear all address/account-wide failures. Up to five previously successful addresses can remain familiar for the account-wide pause, without bypassing pair/address blocks.

Counts, familiar addresses and limiter state reset on server restart. The summary exposes counts/policy, not keys, passwords or client addresses. An empty summary after restart says nothing about all earlier attempts. Do not repeatedly retry 429or restart production solely to clear a warning. See Security and privacy for exact request/host/CSRF/proxy gates.

# Change your own password

1. Verify intended private editor/session and account.
2. Enter current password, different new password and matching confirmation.
3. Submit once and wait for result.
4. On success, fields clear, other sessions end and this session/CSRF is replaced.
5. Recheck expected sign-in/session behavior privately.

Password policy is 12-256 JavaScript string characters and a fixed exact weak-password list, with NFKC normalization for scrypt hashing. It does not require a character-class mix or query all leaked passwords. Never store passwords in Markdown, screenshot, URL or shared support report.

The form changes the signed-in administrator’s password. It is not an arbitrary user’s reset. Editor-account browser reset and administrator shell recovery have different forced-change/enable behavior, documented in Accounts and access.

A lost response creates uncertainty, not permission to repeat blindly. Inspect current session/login outcome through the private workflow. Clearing password fields does not delete server documents or browser Markdown recovery drafts.

# Activity filters and pagination

Activity offers event dropdown plus actor/target fields. Filter values are exact matches, not substring/full-text search. Actor/target text is trimmed by the UI; case-sensitive stored values still matter. Use Filter to replace the list; Load more appends from the returned opaque record-ID cursor.

The fixed dropdown reflects these recorded event names. A section-settings target is section name; section-rename target is old folder name. Global settings/link records can target acting username. Do not assume every target means a person or every event includes all changed fields.

Records show time, event and Actor / target. Missing actor is labeled Unauthenticated or system. Failed login/block records do not verify the typed account owner’s authorship; do not blame that person from the target string. Records omit passwords, tokens, CSRF, client addresses, request bodies and arbitrary build error text.

Load more uses record ID rather than timestamp, preserving records with equal timestamps. Retention can remove the cursor; a missing cursor yields no older page. Re-filter/reload current retained history instead of treating that as a backend guarantee of no previous records. Local insertion order is newest-first, not a global/off-host chronology.

# Publishes and current state

Reload fetches history and current publisher status. Load more uses its own 25-record cursor. History only includes records carrying a publish summary; there is no automatic grouping/deduplication of started/completed entries into one transaction card. A crash can leave started without done/failed.

The empty message says “No completed publish history yet” when no records were returned. Treat it as view text, not proof that no start occurred or every prior job completed. Stored records can outlive the in-memory current job; restart changes live publisher/session state without deleting valid retained files.

Publish Changes uses the shared staged publisher. System’s publish action refuses while unsaved access/content/site/password edits remain. Closing progress does not cancel a job. Other administrators can observe the same active job. History does not retry, restore output, roll back or prove remote deployment.

The saved-changes marker fingerprints selected source metadata, not cryptographic content integrity. Equal size/timestamp edits can evade that comparison; local CLI build does not automatically refresh the editor marker. Inspect actual saved source/output/reader before concluding “matches” means complete/current/correct.

Detailed errors remain in the current progress dialog, not arbitrary persisted audit error dumps. A post-output marker/history failure can follow successful output replacement. Reconcile source, staging/backup/output and returned stage before another publish. See Publishing stages and Health and diagnostics.

# Retention, storage and integrity

Rotation is size-based, not a guaranteed daily/monthly schedule or exact four-MiB quota. Append can exceed threshold; next append rotates. The store reads retained files, skips invalid JSON/required-field records and cannot prove missing/mutated lines. File mode on creation is private 0600; existing parent/file permissions still require operator inspection.

A failed append sets History storage warning without reversing the completed account/source/publication action. Later successful append clears that warning, not the historical gap. Inspect actual state, free space and selected runtime permissions before repeating. Backup protected runtime; do not copy it into public output.

If your organization requires off-host retention, immutable evidence, alerts or compliance exports, provide an external process. V2 does not supply those services. Audit events also are not full document revisions, per-read tracking, device identity or durable sessions.

# A safe investigation sequence

Record non-secret event type/time, synthetic reproducer and observed state. Keep passwords, tokens, private source, users hashes and raw client details out of public reports. Reproduce on disposable content where possible and state what remains untested.

This handbook verified isolated engine tests and local browser behavior; it does not certify production audit retention, TLS, account restoration, organizational policy or external monitoring. Validation limits defines those boundaries.