# Optional editor

V2 includes an optional authenticated writing server. Generated reader works without it. markstack.app is documentation only and hosts no public editing service. Activate editor on your own local/private installation, not as a requirement for static readers.

# Choose a writing workflow

Browser writing is useful for source/preview and assigned-section access. It does not remove Git/history/backups/review or provide SSO/MFA, built-in TLS, realtime collaboration or per-page revision undo. Choose it because writers need it, not because reader navigation requires it.

# Preflight before accounts

Verify selected checkout/package, Node 24+, dependencies and intended content/static/output paths. Editor content/static/output are fixed engine-root paths in this pin; there is no equivalent general editor --content/--out CLI override. A previous custom CLI build does not retarget the writing server. Inspect the intended installation layout rather than editing a different sibling content tree.

Choose protected users path before creation. Default .markstack/users.json is suitable for local exercise. Runtime links/settings/history/marker live beside selected users file in ordinary CLI startup. Create/reset/start must agree on users file; wrong path can make a known account appear absent.

Use Administrator and editor for complete Unix/PowerShell path-specific setup and Environment variables for exact defaults/overrides. Do not publish private runtime or put passwords in command arguments/source/chat.

# Local activation

After completing First site, run from intended project root:

npm run editor:create-admin -- --user admin
npm run editor

Creation asks hidden password twice, validates policy and refuses duplicate name. Choose unique private password of 12-256 characters, not fixed common weak value. It creates account, not starts service or builds reader. Existing account should be recovered deliberately, not replaced just because a different store was selected.

Default listener is http://127.0.0.1:3001. Open it on same machine and sign in. Another machine’s 127.0.0.1 refers to itself, not your server. Default loopback is not a team network deployment. Explicit host/port/allowed-host/cookie/proxy settings need the actual environment.

# First checked writing cycle

1. Confirm intended server/account and physical content tree.
2. Open synthetic authorized page and read current source.
3. Edit complete useful text and inspect preview.
4. Save; wait and recheck exact server text.
5. Administrator reviews all saved publication inputs.
6. Publish/build; inspect local reader and staged result.
7. Release to remote host if separately authorized/configured.
8. Verify root/deep/search/media and intended reader access.

Preview, browser recovery, source Save, local Publish, Git and hosting are separate. Save, publish and deploy identifies the first missing layer. Repeated Save cannot repair provider deployment and repeated deploy cannot include an unsaved browser draft.

# Role capabilities

Administrators have global writing management. Section editors cannot publish or manage users/global settings. Root section-folder mutation is admin-only. Browser role screen is not the security boundary; server enforces it.

Test a fictional editor in separate session/profile: allowed section save, other/root source denial, Admin/publication denial. Then change grants and verify invalidation/fresh login. An administrator seeing everything is not proof a writer is restricted.

# Private team deployment

Do not expose port 3001 directly and call it production-ready. Editor has no built-in HTTPS/SSO/MFA; a proxy/network boundary is separate work. Trusted forwarding accepts exact configured addresses or loopback shorthand, not arbitrary CIDR trust.

Private team editor, Linux team service and HTTPS proxy contain source-grounded templates with explicit deployment limits. A syntax-valid unit/proxy is not a tested production service.

# Concurrency, backup and stop

Ordinary Markdown Save can overwrite concurrent source; no realtime cursor/three-way merge/revision undo is provided. Coordinate page ownership/review and keep protected source history. Browser recovery is not encrypted/synchronized backup and remains after sign-out.

Sessions/jobs/limiter/familiar-address state are process-local. Restart ends sessions and requires fresh sign-in, without erasing browser drafts or saved accounts. Do not restart solely to hide a warning or pretend unfinished publication completed. Reconcile any job/output before service maintenance.

Local foreground stop is Ctrl+C. Saved Markdown/accounts/runtime remain; independently served static reader does not depend on editor staying up. Service-managed stop/restart uses operator’s reviewed service procedure instead.

# Readiness gate

Local tests/screenshots do not certify service startup, TLS, organizational ACLs, actual devices or production restoration. Validation limits keeps those boundaries visible.