ysk-server-shared 1.0.0 → 1.1.0

package/locales/en/projects.json

@@ -21,13 +21,16 @@
   "template": "Template (optional)",
   "templateNone": "— none —",
   "searchPlaceholder": "Search name, domain, or ID…",
+  "listDesc": "Manage sites on this host.",
   "filterAll": "All runtimes",
   "statTotal": "Total",
   "statRunning": "Running",
   "statDegraded": "Degraded",
   "statUnhealthy": "Unhealthy",
   "statStopped": "Stopped / ready",
-  "statPendingOs": "Pending OS",
+  "statStoppedOnly": "Stopped",
+  "statReadyOnly": "Ready",
+  "statPendingOs": "OS user pending",
   "status": {
     "failed": "Failed",
     "failedHint": "Deploy or health check failed — check logs",
@@ -72,7 +75,12 @@
     "httpStatus": "HTTP",
     "latency": "Latency",
     "error": "Error",
-    "at": "Checked at"
+    "at": "Checked at",
+    "deployMode": "Deploy mode",
+    "edgeKind": "Edge",
+    "goLiveOk": "Go-live",
+    "goLiveAt": "Go-live at",
+    "degraded": "Degraded"
   },
   "railPhp": "PHP / site",
   "railStatic": "Static site",
@@ -86,7 +94,16 @@
   "neverDeployed": "Never deployed",
   "created": "Created {{name}}",
   "backToList": "Back to projects",
-  "openUrl": "Open URL",
+  "openUrl": "Open site",
+  "openUrlNeedDomain": "Set a domain first — do not open 127.0.0.1 in your browser",
+  "needOsUser": "Create the system user on the Isolation tab first",
+  "goIsolation": "Open Isolation tab",
+  "homeMissing": "Home directory does not exist",
+  "homeMissingHint": "Same live probe as migrate inventory — create the system user on Isolation",
+  "stopTitle": "Stop this project (systemd unit and public site)",
+  "deployTitle": "Deploy this project",
+  "httpStatsHint": "From this project’s access log (last sample)",
+  "httpStatsNone": "No project access log yet",
   "notFound": "Project not found",
   "home": "Home directory",
   "env": "Environment",
@@ -136,8 +153,8 @@
   "healthUnknown": "Not checked",
   "sectionRuntimeDeploy": "Runtime deploy",
   "sectionRuntimeDeployDesc": "Start the process for this project runtime (Node / PHP)",
-  "sectionGit": "Git deploy",
-  "sectionGitDesc": "Pull from Git and redeploy",
+  "sectionGit": "Git",
+  "sectionGitDesc": "Clone, sync, and inbound push",
   "sectionEnv": "Environment variables",
   "sectionEnvDesc": "Write KEY=value lines to the project .env",
   "gitUrl": "Git URL",
@@ -183,7 +200,7 @@
   "nginxValuePublished": "Published",
   "nginxValueNone": "Not published",
   "osValueReady": "Ready",
-  "osValuePending": "Pending",
+  "osValuePending": "OS user pending",
   "openFiles": "Files",
   "enableCdn": "Enable CDN",
   "openLogs": "Logs",
@@ -192,10 +209,11 @@
   "osUserIncomplete": "System user provisioning incomplete",
   "saveLogDirsFailed": "Failed to save log directories",
   "createName": "Project name",
+  "noPathSepHint": "The name cannot contain / or \\.",
   "createRuntime": "Runtime",
   "createRuntimeHint": "You can change deploy options later in detail",
   "createVersion": "Version",
-  "createVersionHint": "Stored as runtime_version; used by deploy / FPM",
+  "createVersionHint": "Writes the project runtime version setting; deploy / FPM uses it",
   "createVersionAria": "Runtime version",
   "createPrimaryDomain": "Primary domain",
   "createPrimaryDomainHint": "Optional for now",
@@ -339,8 +357,16 @@
   "netHttpsDesc": "Publish Nginx after save. Full-site 301 overrides proxy/PHP/static content",
   "netForceHttps": "Force HTTPS",
   "netForceHttpsDesc": "HTTP → HTTPS (301); needs SSL cert and SSL publish",
+  "netForceHttpsOn": "HTTP will redirect to HTTPS after you publish the edge.",
+  "netForceHttpsOff": "No forced redirect is stored.",
+  "netBoundCert": "Bound certificate",
+  "netBoundCertExpiry": "expires {{at}}",
+  "netNoBoundCert": "No certificate on disk for this hostname",
+  "netForceHttpsNeedCert": "Issue a certificate on /ssl for this domain before forcing HTTPS.",
+  "netHttpsLiveNotForced": "An edge file exists; HTTPS may already work. This box only forces HTTP→HTTPS.",
   "netHsts": "Enable HSTS",
   "netHstsDesc": "Browsers stick to HTTPS (recommended after force HTTPS)",
+  "netHstsNeedHttps": "Turn on force HTTPS first",
   "netRedirectUrl": "Full-site redirect URL",
   "netRedirectHint": "Optional. Full-site 301 to this URL (move / apex→www)",
   "netBasicAuthTitle": "HTTP basic auth (browser login)",
@@ -461,7 +487,7 @@
   "deployPhpIniSaved": "Project php.ini overrides saved; deploy or apply FPM again",
   "deployHistory": "Deploy history ({{count}})",
   "deployHistoryDesc": "From audit; newest first",
-  "deployGitUrlHint": "HTTPS or SSH repo URL; sync then redeploy by runtime",
+  "deployGitUrlHint": "HTTPS or git@host:org/repo.git",
   "deployEnvHint": "One KEY=value per line; # comments",
   "resume": "Resume project",
   "suspend": "Suspend project",
@@ -547,14 +573,109 @@
   "netPublishMaint": "Maintenance",
   "sslNeedDomain": "Set a domain before publishing Nginx / SSL.",
   "createTemplateMissing": "{{v0}} ；「— —」。",
-  "deleteDialogDesc": "「{{v0}}」。。",
+  "deleteDialogDesc": "This permanently deletes “{{name}}”. It cannot be undone.",
   "deleteWillStop": "systemd / PM2 /",
   "deleteWillWeb": "Nginx conf、PHP-FPM pool、Apache vhost（）",
   "deleteWillOs": "Linux home （）",
   "deleteKeepOs": "home Linux （）",
   "deleteWillDb": "…",
   "deleteRemoveFilesDesc": "Cancel，",
-  "deleteTypeNameHint": "「{{v0}}」",
+  "deleteTypeNameHint": "「{{name}}」",
   "deleteDnsWarn": "DNS zone / domain 。",
-  "manageInNginx": "Manage in Nginx"
+  "manageInNginx": "Manage in Nginx",
+  "advFtpHomeApp": "Site app directory",
+  "advFtpHomeRoot": "Project home (full)",
+  "advFtpManage": "Open FTP page",
+  "resShell": "Login shell",
+  "resSaveHint": "Save and apply changes the live OS. Control-plane only stores the form. Re-apply uses the last saved values.",
+  "resBashConfirmTitle": "Allow interactive bash?",
+  "resBashConfirmDesc": "This grants an interactive login shell to the project user. Confirm only if you need SSH or PTY as that user.",
+  "createGitHint": "Optional. Stored on the project; clone from the Deploy tab (does not clone on create).",
+  "gitTokenLaterHint": "HTTPS token and clone depth are set on the project Deploy tab after create.",
+  "gitBranch": "Branch",
+  "gitBranchHint": "Pick a remote branch or tag.",
+  "gitBranchAfterUrl": "Enter a Git URL first. Empty uses the remote default branch.",
+  "gitLastRef": "Last sync: {{branch}} @ {{commit}}",
+  "gitConfirmTitle": "Clone into this project?",
+  "gitConfirmBody": "If app/ is still the Hello World placeholder it will be cleared, then cloned. Custom files that are not a YSK scaffold are refused.",
+  "gitConfirmRemoteBody": "This points origin at the new URL and pulls. Unrelated histories fail; custom files are not wiped.",
+  "runtimeActual": "Actual binary {{path}}",
+  "runtimeFallback": "Chosen {{version}} is not on this host. Process uses {{path}}.",
+  "gitSync": "Sync",
+  "gitFetch": "Fetch",
+  "gitCheckout": "Checkout",
+  "gitReset": "Reset to remote",
+  "gitResetNeedConfirm": "Needs confirmation — discards local commits",
+  "gitDeepen": "Fetch full history",
+  "gitLogTitle": "Recent commits",
+  "gitDirtyTitle": "Local changes block pull",
+  "gitDirtyBody": "{{count}} file(s) differ from Git (Files edits or the app). Discard them or abort.",
+  "gitSyncBlockedDirty": "Sync is disabled until local changes are discarded (Reset) or the files match Git.",
+  "gitViewDiff": "View diff",
+  "gitDiscard": "Discard local files",
+  "gitOpenFiles": "Open in Files",
+  "gitNotCloned": "Not cloned",
+  "gitClean": "Clean",
+  "gitDirty": "Dirty",
+  "gitBehind": "Behind {{count}}",
+  "gitAhead": "Ahead {{count}}",
+  "gitDetached": "Pinned",
+  "gitShallow": "Shallow",
+  "gitMissing": "git missing",
+  "gitResetConfirmTitle": "Reset hard to remote?",
+  "gitResetConfirmBody": "This discards local Git history and untracked files except .env, then restores .env from the control plane.",
+  "gitHeads": "Remote branches",
+  "gitToken": "HTTPS token",
+  "gitTokenHint": "Encrypted at rest. Never stored in the remote URL.",
+  "gitTokenPlaceholder": "ghp_… or glpat-…",
+  "gitTokenSet": "Token set",
+  "gitSaveToken": "Save token",
+  "gitClearToken": "Clear token",
+  "gitDeployKey": "Deploy public key",
+  "gitDeployKeyHint": "Add this as a read-only deploy key on the Git host.",
+  "gitDeployKeyOn": "Deploy key",
+  "gitMakeKey": "Create deploy key",
+  "gitCopyPub": "Copy public key",
+  "gitClearKey": "Clear deploy key",
+  "gitKeyCopied": "Public key copied",
+  "gitPinHost": "Pin host key",
+  "gitPinHostBody": "{{host}} is not pinned. Confirm the fingerprints, then pin before SSH clone.",
+  "gitHostUnpinned": "Host key not pinned",
+  "gitHookTitle": "Push hook",
+  "gitHookHint": "Paste the URL into GitHub / Gitea / GitLab (push only). Not Slack.",
+  "gitHookOn": "On",
+  "gitHookOff": "Off",
+  "gitHookEnable": "Enable",
+  "gitHookRotate": "Rotate secret",
+  "gitHookDisable": "Disable",
+  "gitHookSecretOnce": "Copy this secret now — it will not be shown again.",
+  "gitHookCopyUrl": "Copy",
+  "gitHookCopySecret": "Copy secret",
+  "gitHookCopied": "Copied",
+  "gitHookSetup": "Payload URL = the URL above. Content type application/json. Events: push only. Secret = the one-time value.",
+  "gitHookGithub": "Settings → Webhooks → Add webhook. Content type application/json. Events: Just the push event. GitHub.com needs HTTPS.",
+  "gitHookGitea": "Settings → Webhooks → Add Webhook → Gitea. Method POST. Event: Push.",
+  "gitHookGitlab": "Settings → Webhooks. Trigger: Push events. Secret token = hook secret (X-Gitlab-Token).",
+  "gitHookHonesty": "Host unit needs YSK_EXECUTE=1 or the hook only returns a plan.",
+  "gitHookSkipOther": "Other branches are ignored.",
+  "gitAuthHttps": "HTTPS token",
+  "gitAuthSsh": "SSH deploy key",
+  "gitLoadRefs": "Load branches",
+  "gitRefDefault": "Remote default",
+  "gitRefBranches": "Branches",
+  "gitRefTags": "Tags",
+  "gitRefOther": "Other ref…",
+  "gitRefCustom": "Commit or ref",
+  "gitRefsNeedUrl": "Enter a URL first.",
+  "gitRefsNeedAuth": "Save a token or deploy key, then load branches.",
+  "gitRefsHint": "Loaded from the remote. Choose one — do not type.",
+  "gitHookSetupToggle": "How to paste this",
+  "gitHookOneLiner": "HMAC or X-YSK-Git-Hook. Only this project’s ref.",
+  "gitHookExecuteHint": "Needs YSK_EXECUTE=1 to clone or deploy.",
+  "gitShowKey": "Show key",
+  "gitHideKey": "Hide",
+  "gitBehindShort": "↓{{count}}",
+  "gitAheadShort": "↑{{count}}",
+  "gitDirtyShort": "Dirty · {{count}}",
+  "gitFilesLink": "Files"
 }

package/locales/en/protection.json

@@ -30,7 +30,9 @@
   "note": {
     "notApplied": "Not applied on host (needs root + YSK_EXECUTE=1) — saved to panel settings",
     "nginxWritten": "Wrote Nginx rate-limit panel file",
-    "f2bWritten": "Wrote fail2ban panel settings"
+    "f2bWritten": "Wrote fail2ban panel settings",
+    "hintDropped": "Internal protection hint omitted",
+    "nginxLimits": "Will write Nginx rate-limit snippet"
   },
   "rel": {
     "justNow": "Just now",
@@ -53,6 +55,10 @@
   "autoBanAutomation": "Auto-ban: {{onOff}} ({{mode}})",
   "automationSaved": "Automation settings saved",
   "statFirewall": "Firewall",
+  "statSuspects": "Suspect IPs",
+  "statSuspectsSplit": "{{actionable}} actionable / {{total}} listed",
+  "suspectActionableCount": "Actionable IPs {{count}}",
+  "scoreBasisHint": "Listed suspects vs IPs you can still ban (excludes already banned / whitelist).",
   "statAutoBan": "Auto-ban",
   "statApply": "System apply",
   "statActiveBans": "Active bans",
@@ -72,6 +78,12 @@
   "reapply": "Re-apply",
   "nginxLimits": "Nginx rate limits",
   "notWritten": "Not written",
+  "modeValue": {
+    "normal": "Normal",
+    "degraded": "Degraded",
+    "ddos-protection": "DDoS protection",
+    "offline": "Offline"
+  },
   "mode": "Mode",
   "controlPlane": "Control plane",
   "canApply": "Can apply",
@@ -179,6 +191,10 @@
   "dbReady": "DB ready",
   "stale": "Stale",
   "older7d": ">7 days",
+  "freshnessNa": "n/a",
+  "freshnessMissing": "No database",
+  "freshnessStale": "Stale",
+  "freshnessFresh": "Current",
   "lastSuccess": "Last success",
   "downloaded": "Downloaded",
   "missing": "Missing",
@@ -233,10 +249,19 @@
   "sectionAutoBan": "② Auto-ban",
   "unban": "Unban",
   "ban": "Ban",
+  "banConfirmTitle": "Ban {{ip}}?",
+  "banConfirmDesc": "This IP will be blocked on the host. Confirm it is not a current panel or session address.",
+  "wlRemovedUndo": "Removed {{ip}} from the allow list. Undo within 5 seconds.",
+  "undo": "Undo",
+  "banSelectedConfirmTitle": "Ban {{count}} selected IPs?",
+  "banSelectedConfirmDesc": "These addresses will be blocked on the host: {{ips}}",
   "save": "Save",
   "yes": "Yes",
   "no": "No",
   "oneClickSuggested": "Apply suggested preset",
+  "stackApply": "Apply protection stack (UFW, fail2ban, preset)",
+  "stackApplyDone": "Protection stack apply requested",
+  "stackApplyHint": "This enables UFW and applies fail2ban plus the suggested preset. Confirm you will not lock yourself out of a remote panel.",
   "viewPresets": "View presets",
   "suspectIpsCount": "Suspect IPs {{count}}",
   "goBans": "Go to bans",
@@ -292,7 +317,12 @@
   "f2bTool": "fail2ban tool",
   "noSecondJail": "(no second jail editor here).",
   "autoBanWhitelistTitle": "Auto-ban whitelist",
-  "autoBanWhitelistDesc": "Protection auto-ban exemptions (syncs fail2ban ignoreip",
+  "autoBanWhitelistDesc": "Protection auto-ban exemptions (syncs fail2ban ignoreip).",
+  "ufwOff": "UFW (off)",
+  "ufwOffHint": "UFW is not active — fail2ban is the usable target.",
+  "whitelistSyncHint": "{{n}} panel entries · fail2ban ignoreip sync: {{sync}}",
+  "whitelistSyncOn": "on",
+  "whitelistSyncOff": "off (lists may differ)",
   "ignoreipWhitelist": "ignoreip whitelist",
   "notSetSuggestAdmin": "Not set (add your admin IP)",
   "moreItems": "… {{n}} more · see fail2ban whitelist",
@@ -306,6 +336,11 @@
   "fullLogsAt": "Full nginx/auth logs:",
   "logCenter": "Log center",
   "colScore": "Score",
+  "colHits": "Hits",
+  "col429": "429",
+  "topIpsTitle": "Top IPs",
+  "hitsCount": "{{n}} hits",
+  "sampleWindowHint": "Counts are from the current access + auth sample window, not the full log file.",
   "banShort": "Ban",
   "vhostLimits": "Vhost rate limits",
   "eventStream": "Event stream",
@@ -344,5 +379,33 @@
   "plusRegion": "+ region {{v}}",
   "plusCity": "+ city {{v}}",
   "lastTickPrefix": "· last {{t}}",
-  "nextTickPrefix": "· next {{t}}"
+  "nextTickPrefix": "· next {{t}}",
+  "cannotBanSelf": "Cannot ban {{ip}} — this is the host, your login, or ignoreip",
+  "selfIp": "This host",
+  "selfHostIp": "Host IP",
+  "selfLoginIp": "Your login IP",
+  "showZeroScore": "Show 0-score",
+  "hideZeroScore": "Hide 0-score",
+  "geoDraftOnly": "Policy is off — Save stores a draft only. Nginx will not enforce until you enable it.",
+  "geoNeedDb": "GeoIP databases are missing — update the MMDB files first",
+  "uaNeedZones": "Set a Cloudflare zone first",
+  "provider": "Provider",
+  "selectAllCountriesWarn": "Select all countries in block-list mode? That can lock out this host and your login country.",
+  "badgeRecommendPreset": "A stronger preset is recommended for the current threat",
+  "badgeAutomationOn": "Automation is on",
+  "badgeBanCount": "Active bans",
+  "badgeGeoOn": "Geo access policy is on",
+  "badgeGeoNotReady": "GeoIP database is not ready",
+  "badgeIntelSignals": "Signals that currently add score",
+  "signalActive": "Active",
+  "signalInactive": "Inactive",
+  "signalJails": "{{n}} jail(s)",
+  "dbReadyHint": "MMDB files are present",
+  "dbNotReadyHint": "Download a GeoIP database first",
+  "staleHint": "Whether the last successful update is older than 7 days",
+  "draftBadge": "Draft",
+  "banIsSelf": "This IP matches the current panel source or this host.",
+  "banNotSelf": "This IP is not the current panel source.",
+  "geoSourceLocal": "Local GeoIP library (sapics + DB-IP)",
+  "nginxPreviewHint": "Nginx snippet this preset would write (preview only):"
 }

package/locales/en/publicFiles.json

@@ -12,6 +12,10 @@
   "siteSettings": "Site settings",
   "siteSettingsDesc": "Writes managed conf; may reload Nginx on apply (reachable only after apply)",
   "serverNameHint": "Nginx server_name, e.g. files.example.com",
+  "notes": {
+    "noManagedConf": "No managed Nginx conf yet — click Apply",
+    "notSynced": "Managed conf exists but is not under /etc/nginx/conf.d — apply again as root with YSK_EXECUTE"
+  },
   "quotaMiB": "Quota (MiB)",
   "quotaHint": "Optional; caps public directory size",
   "unlimited": "Unlimited",
@@ -19,6 +23,7 @@
   "appliedOk": "Public files site applied",
   "applyReload": "Apply and reload Nginx",
   "statusLive": "Live on nginx",
+  "statusDraft": "Draft / not applied",
   "statusManagedOnly": "Managed only",
   "statusNotApplied": "Not applied",
   "nginxLive": "in conf.d",
@@ -26,7 +31,15 @@
   "openSite": "Open site",
   "notLiveHint": "Domain 404 usually means conf is only under dataDir, not copied to /etc/nginx/conf.d, or nginx was not reloaded. Re-apply with root + YSK_EXECUTE. Use http:// until SSL is issued for this hostname.",
   "diskRoot": "Disk root",
+  "executeFlag": "Execute",
+  "asRoot": "Root",
   "filesInRoot": "Entries",
   "managedConf": "Managed conf",
-  "systemConf": "System conf.d"
+  "systemConf": "System conf.d",
+  "autoindex": "Directory listing (autoindex)",
+  "liveSystemConf": "Live system conf: {{path}}",
+  "publicRootNote": "Public root: {{path}}",
+  "applyConfirmTitle": "Apply public-files site?",
+  "applyConfirmDesc": "Write Nginx server_name {{name}} and reload Nginx.",
+  "serverNameMismatch": "Live conf uses {{live}}; the form has {{draft}}. Apply to replace."
 }

package/locales/en/rbac.json

@@ -80,7 +80,13 @@
     "auditExport": "Audit export",
     "securityApiKeysAdmin": "API keys admin",
     "networkBrowse": "Host-mediated web browse",
-    "networkVnc": "VNC remote desktop"
+    "networkVnc": "VNC remote desktop",
+    "validatorsRead": "Validators (read)",
+    "validatorsManage": "Validators manage",
+    "validatorsWipe": "Validators wipe data",
+    "dockerRead": "Docker (read)",
+    "dockerManage": "Docker manage",
+    "dockerWipe": "Docker wipe / prune"
   },
   "aboutRoles": "Roles (factory defaults)",
   "aboutRolesBody": "Roles set default capabilities; users can override individual ones.",
@@ -96,5 +102,12 @@
   "capabilitiesHint": "Toggle what this role may do",
   "enabledCount": "{{enabled}} of {{total}} enabled",
   "bandAboveMax": "Above max level",
-  "dirtyHint": "Customized (differs from factory)"
+  "roleUnavailable": "Not available for this role",
+  "dirtyHint": "Customized (differs from factory)",
+  "unsaved": "Unsaved",
+  "unsavedHint": "Unsaved edits on this role",
+  "nothingToSave": "Nothing to save",
+  "saveRole": "Save {{role}} policy",
+  "discardTitle": "Discard unsaved policy?",
+  "discardDesc": "Switching roles drops unsaved capability edits."
 }

package/locales/en/readiness.json

@@ -25,12 +25,22 @@
   "checkFailed": "Readiness check failed",
   "gatePass": "Gate passed · {{pct}}%",
   "gateFail": "Not ready · {{pct}}%",
+  "gateBlocked": "Not passed · {{n}} missing",
   "executeOn": "On",
   "executeOff": "Off",
   "blockers": "Blockers",
+  "blockersHint": "Blockers are the critical subset of Missing — not extra checks.",
+  "requireAdminTotp": "require admin 2FA policy",
+  "listenBind": "listen address",
+  "item": { "admin2fa": "Admin two-factor" },
+  "dataDirPerms": "panel data-directory permissions",
+  "mode750": "mode 750",
+  "totalChecks": "All checks",
+  "totalChecksHint": "Ready + degraded + missing = this total. Blockers are the critical missing subset.",
   "probing": "Probing…",
   "reprobe": "Re-probe",
   "exportReport": "Export report",
+  "exportStarted": "Downloading {{name}}",
   "firstBlocker": "Fix first blocker",
   "viewRecommended": "View recommended",
   "loadingProbe": "Probing host capabilities…",
@@ -107,5 +117,24 @@
   "fixNow": "Fix now",
   "fixFailed": "Fix failed",
   "fixDone": "dataDir permissions hardened (chmod 750)",
-  "fixDoneWebUi": "Web UI built / installed"
+  "fixDoneWebUi": "Web UI built / installed",
+  "rootLabel": "Superuser",
+  "techDetails": "Technical details",
+  "missingOwner": "No panel owner assigned (package quota attribution)",
+  "notOsProvisioned": "OS user pending (home not provisioned)",
+  "isolationPendingOs": "Same as project status: OS user pending. Open Isolation to provision the system user and home.",
+  "ondrejNone": "No ondrej Launchpad PHP sources detected",
+  "ondrejFound": "Found legacy ondrej/php sources that conflict with packages.sury.org: {{paths}}",
+  "ondrejTitle": "PHP apt source (ondrej residual)",
+  "systemctlActive": "Service is running",
+  "systemctlStatus": "Service status: {{status}}",
+  "binInPath": "{{bin}} in PATH",
+  "leftoverApache": "Apache leftover default site",
+  "leftoverVsftpd": "vsftpd unit failed",
+  "leftoverCli": "Stale leftover CLI",
+  "leftoverNginx": "Nginx catch-all missing",
+  "leftoverDovecot": "Dovecot TLS points at missing cert",
+  "leftoverOther": "Host leftover",
+  "leftoverApply": "Leftover apply",
+  "isolationOwnerDegrades": "Missing owner_user_id affects package quota attribution — status is degraded, not ready."
 }

package/locales/en/redis.json

@@ -28,6 +28,8 @@
   "keysCountSuffix": " · {{n}} key(s)",
   "searchPlaceholder": "Search keys, e.g. user:* or *",
   "searchKeys": "Search keys",
+  "scanHint": "Uses SCAN, not KEYS. Returns at most {{n}} keys — avoid * on huge databases.",
+  "scanCapped": "Showing the first {{n}} matches.",
   "rows": "{{n}} row(s)",
   "content": "Content",
   "noMatchingKeys": "No matching keys",
@@ -56,6 +58,8 @@
   "addKey": "Add key",
   "dbLabel": "DB {{i}}",
   "keysInDb": " · {{n}} key(s)",
+  "dbOptionKeys": "DB {{i}} · {{n}} keys",
+  "dbOptionEmpty": "DB {{i}} · empty",
   "dbRange": "{{n}} databases (0–{{max}}).",
   "serviceLink": "Change count in service settings",
   "dbsWithData": "DBs with data (quick)",
@@ -64,5 +68,19 @@
   "pickKey": "Select a key on the left to view content.",
   "ttlPrefix": "TTL: {{ttl}}",
   "writeLiveHint": "Writes live Redis; cannot undo from the panel in one click.",
-  "refPath": "Ref: {{path}}"
+  "refPath": "Ref: {{path}}",
+  "dbEmptyMark": " · empty",
+  "noRequirepass": "Protected mode is on, but requirepass is empty or unread — no password.",
+  "insecureShort": "No password",
+  "setRequirepass": "Set password",
+  "rdbOnlyLossHint": "AOF is off and RDB is on. A restart or crash can lose recent writes.",
+  "dirDataContainer": "/data (container)",
+  "dirHostDefault": "/var/lib/redis",
+  "dirDefaultInstance": "/var/lib/redis/default",
+  "dirDataWarn": "/data is usually a container path; this panel cannot confirm it exists.",
+  "saveOff": "Disable snapshots (not recommended)",
+  "saveOffWarn": "Empty save string turns RDB snapshots off. A crash can lose all data if AOF is also off.",
+  "dirMoveWarn": "Changing dir does not move dump.rdb / AOF. The next start uses the new path as-is.",
+  "passwordUnset": "Not set on the service",
+  "passwordSetHidden": "Set (not shown)"
 }

package/locales/en/runtime.json

@@ -116,6 +116,9 @@
   "tuneLoadFailed": "Failed to load tuning",
   "availableCount": "{{n}} available",
   "notDetected": "Not detected",
+  "binaryPath": "Binary path",
+  "targetMissing": "Target not installed",
+  "targetMissingHint": "Target {{version}} is not on this host. Bind an installed version or install this pin.",
   "target": "Target",
   "tune": "Tune",
   "loadedShort": "Loaded",
@@ -161,6 +164,8 @@
   "demoNotBind": "(hand-typed pool name) and does not auto-bind project isolation. Global php.ini is on the php.ini tab.",
   "applyOkWritten": "Apply success = files written. Prefer project deploy so User=project Linux user.",
   "applyPhpVhost": "Apply PHP vhost / pool",
+  "applyPhpVhostTitle": "Needs confirm — writes pool/vhost files",
+  "applyPhpVhostDesc": "Will write the {{pool}} pool and {{domain}} vhost. Reload services: {{reload}}.",
   "reprobeTools": "Re-probe tools",
   "pressReprobe": "Press Re-probe tools to load",
   "installNodeLabel": "Install Node {{v}}",
@@ -414,7 +419,8 @@
   "tabProcesses": "Processes",
   "pm2": {
     "title": "PM2 fleet",
-    "desc": "Read-only view of pm2 jlist (panel user PM2_HOME). Live SSE refreshes every 2s.",
+    "desc": "PM2 is a process manager. This tab lists the panel user’s processes (read-only). Live updates use SSE (server-sent events) about every 2 seconds.",
+    "glossary": "PM2 = process manager; SSE = live stream.",
     "live": "Live",
     "installed": "PM2 installed",
     "version": "pm2 version",
@@ -451,15 +457,44 @@
     "projectsCount": "YSK projects",
     "noProjects": "No projects",
     "noProjectsDesc": "No node/bun projects in the panel, or OS user not provisioned.",
-    "pm2OnlyDesc": "Only apps started with PM2 under the panel user. systemd deploys appear above."
+    "pm2OnlyDesc": "Only apps started with PM2 under the panel user. systemd deploys appear above.",
+    "startupTitle": "Start on boot",
+    "startupDesc": "Register PM2 so processes come back after reboot.",
+    "systemdActionsHint": "systemd actions need root and YSK_EXECUTE.",
+    "startupOk": "Startup registered. {{notes}}",
+    "startupFail": "Could not register startup. {{notes}}",
+    "actionOk": "{{action}} {{name}} — {{notes}}",
+    "actionFail": "Could not {{action}} {{name}}. {{notes}}",
+    "startupReady": "Ready",
+    "startupReadyYes": "Yes",
+    "startupReadyNo": "No",
+    "startupUnit": "Unit",
+    "startupDump": "Dump",
+    "startupInstall": "Install startup",
+    "startupSave": "Save process list",
+    "actRestart": "Restart",
+    "actStop": "Stop",
+    "actReload": "Reload",
+    "pm2ActionsHint": "PM2 actions apply to the panel user’s process list only.",
+    "noteUnparsed": "PM2 list could not be parsed (empty or unexpected output).",
+    "notePanelUserOnly": "PM2 list is for the panel process user only.",
+    "noteProjectUnits": "{{n}} YSK project unit(s) listed"
   },
   "recordedInstalled": "Recorded {{v}}",
   "remoteSourceSuffix": " ({{source}})",
   "nodePathYskMissingTitle": "Managed Node path not ready",
   "nodePathYskMissing": "YSK-managed Node for version {{version}} is not ready. Re-probe or reinstall.",
+  "managedPathMissingTitle": "Managed {{name}} path not ready",
+  "managedPathMissing": "YSK-managed {{name}} for version {{version}} is not ready. Re-probe or reinstall.",
   "nodePathUnsafeTitle": "Node path is unsafe",
   "nodePathUnsafe": "Path {{path}} is outside the managed tree; project deploys may fail.",
   "recordedButProbeEmpty": "Panel recorded install {{v}}, but the host probe found no binary. Not installed — re-probe or reinstall.",
+  "installedLabel": "Installed",
+  "installedHint": "Host probe result — not the control-plane record",
+  "targetHint": "Version this page will install or pin",
+  "panelDefaultHint": "Default used by new projects",
+  "rebuildFromHost": "Rebuild record from host",
+  "rebuiltFromHost": "Record refreshed from host probe",
   "tabTuning": "Tuning",
   "versionPlaceholder": "Latest，",
   "pluginsBundleWithRuntime": "Tools「Install runtime」Install（Install）。",
@@ -505,5 +540,18 @@
   "path": "Path",
   "fullVersion": "Full version",
   "useListForDefaults": "To change host or panel default, or remove this version, use the list above.",
-  "alreadyHostDefaultShort": "Host default"
+  "alreadyHostDefaultShort": "Host default",
+  "installRecordedCta": "Install recorded {{v}}",
+  "needsInstall": "needs install",
+  "needsInstallHint": "Not on this host. Install it first, or pick an installed version.",
+  "unitBytes": "bytes",
+  "headerSizeKb": "{{n}} KB",
+  "phpIniChipEmpty": "Not loaded — open the php.ini tab",
+  "phpFpmService": "PHP-FPM",
+  "phpFpmServiceDesc": "Start, stop, reload, or restart the PHP-FPM unit",
+  "rustupDefaultMissingTitle": "No rustup default toolchain",
+  "rustupDefaultMissing": "rustup has no default toolchain. Set one (stable) on the Software tab.",
+  "rustupDefaultMissingShort": "No default toolchain",
+  "rustupSetDefaultHint": "Set default toolchain",
+  "uninstalledCountHint": "{{n}} version(s) not on this host"
 }

package/locales/en/search.json

@@ -20,5 +20,9 @@
     "cron": "Cron",
     "user": "Users",
     "other": "Other"
+  },
+  "alias": {
+    "ssl": "cert certificate certs",
+    "projects": "project sites"
   }
 }