Preflight or installation fails
Check the exact kit release, independent checksum, complete bundle membership, protected ownership/modes and supported Ubuntu/systemd/AppArmor/ext4 environment. Retain the plan, digest and sanitised finding. Do not disable confinement, delete unknown configuration or overwrite another panel to force a pass.
Run the matching release's read-only panelctl doctor and compare the reported owned listener, UID/profile, package and service checks. An unhealthy agent can prevent packages or accounts even when the browser UI loads.
The browser cannot sign in
Confirm the SSH tunnel is still open and that the browser uses the exact configured HTTPS origin. Check the installation certificate through trusted access. Confirm Admin versus Customer, your own enrolled credentials, server/authenticator time and MFA. Do not disable TLS or substitute Linux root credentials for the default Panel login.
Expired first enrollment or lost factors require the protected local identity recovery described by the matching release. Preserve private metadata and enrollment state.
An action is denied or stuck
Check current role/grants, authentication freshness, licence status, service capability and the original durable operation. Keep the exact correlation reference and inspect observed effects before another submission.
For support, provide release/version, the safe operation reference, action, time and sanitised output. Exclude passwords, session cookies, recovery codes, private keys, full database dumps and customer mail.