ysk-server-shared 1.0.0 → 1.1.0

package/locales/en/translation.json

@@ -26,9 +26,10 @@
     "fleet": "Fleet",
     "aiTasks": "AI tasks",
     "expBanner": "Experimental.",
-    "expBody": "Registration ≠ online. Real ops use CLI:",
-    "expDocs": "Docs: repo",
-    "expPayload": "; command payload recommendation",
+    "expBody": "Registration ≠ online. Real ops use the CLI:",
+    "expDocs": "Repository file:",
+    "expEdge": "On an edge:",
+    "expPayload": "Command payload example:",
     "fleetCan": "What the fleet can do",
     "fleetCanDesc": "Not a hollow list — real control-plane capabilities for edge nodes",
     "capRegister": "Register",
@@ -40,7 +41,14 @@
     "capDelete": "Delete",
     "capDeleteD": "Removes session and related messages",
     "capStatus": "Status",
-    "capStatusD": "Registered only → online (heartbeat) → stale (>60s without heartbeat)",
+    "capStatusD": "Registered only → online (heartbeat) → stale (>60s without heartbeat) → offline (disconnected / no further heartbeat)",
+    "statusFlowTitle": "Status flow",
+    "statusFlow": "Registered only → online → stale (>60s) → offline (disconnected). Filter “Offline” is disconnected.",
+    "colSession": "Session UUID",
+    "copySession": "Copy session UUID for cluster / CLI --session",
+    "staleFor": "Unseen {{age}}",
+    "commandTitle": "Queue a command for this session",
+    "historyTitleShort": "Open command history (read-only)",
     "fleetTitle": "Fleet ({{count}})",
     "fleetDesc": "Control-plane registry · registered ≠ node online",
     "registerPlus": "+ Register agent",
@@ -130,7 +138,9 @@
     "labelStderr": "stderr",
     "labelAckCli": "ack + CLI JSON",
     "labelStdoutBody": "CLI stdout body",
-    "resultOuterHint": "Outer result is CLI --json stdout."
+    "resultOuterHint": "Outer result is CLI --json stdout.",
+    "noteAllowlist": "Agent tool calls must pass the allowlist.",
+    "noteRbacCap": "Agent role is capped at write-low."
   },
   "ai": {
     "status": {
@@ -213,6 +223,8 @@
     "sourceProject": "Project",
     "sourceStandalone": "Standalone",
     "sourceArtifact": "On disk",
+    "sourceOrphan": "Leftover",
+    "orphanSite": "Project gone",
     "openProject": "Open project",
     "kindLabel": "Type",
     "kindProxy": "Proxy",
@@ -221,6 +233,7 @@
     "upstreamLabel": "Upstream",
     "rootLabel": "Document root",
     "sslLabel": "SSL",
+    "sslTerminatedUpstream": "TLS ends at front Nginx",
     "apply": "Apply",
     "notInstalled": "Apache not installed",
     "globalSettings": "Global settings",
@@ -244,6 +257,7 @@
     "removeArtifact": "Remove residual",
     "removeArtifactTitle": "Remove residual conf?",
     "removeArtifactDesc": "Delete this unclaimed Apache conf from the panel data directory and disable the system twin when possible. Does not delete the project.",
+    "removeArtifactHint": "Deletes this leftover disk conf. Does not delete the project.",
     "previewConf": "Preview conf",
     "cleanupConflicts": "Clean conflict residuals",
     "cleanupConflictsTitle": "Clean all conflict residuals?",
@@ -285,7 +299,10 @@
       "project.publish": "Publish Nginx",
       "project.suspend": "Suspend project",
       "software.install": "Install software",
-      "software.update": "Update software"
+      "software.update": "Update software",
+      "backup.restore": "Backup restore",
+      "backup.run": "Backup run",
+      "backup.delete": "Backup deleted"
     }
   },
   "backups": {
@@ -304,6 +321,7 @@
     "backupFiles": "Backup files",
     "projects": "Projects",
     "lastAll": "Last all",
+    "latestFile": "Latest archive",
     "remote": "Remote",
     "withBackups": "Projects with backups",
     "ops": "Actions",
@@ -317,6 +335,10 @@
     "preview": "Preview",
     "restoreWeb": "Restore web",
     "restoreFull": "Full restore",
+    "restoreFullTitle": "Overwrite project files and databases from this archive — type the file name to confirm",
+    "restoreWebTitle": "Restore website files only from this archive",
+    "previewTitle": "Preview restore without writing",
+    "partialSkipped": "Partial — some projects skipped",
     "delete": "Delete",
     "opsTitle": "Actions",
     "opsHint": "0 projects or all skipped = success;",
@@ -371,6 +393,7 @@
     "endpointOptional": "Endpoint (optional)",
     "localMirror": "Local mirror path",
     "remotePath": "Remote path",
+    "remotePathHint": "Relative to the remote user’s home (or SFTP chroot). “.” is that home.",
     "resticTitle": "Restic incremental",
     "resticDesc": "Optional; restic on PATH. Password required when enabled (no default)",
     "enableRestic": "Enable restic",
@@ -410,7 +433,7 @@
     "resticOverwriteDone": "restic overwrite home complete",
     "opsResult": "Ops result",
     "filesTitle": "Backup files ({{count}})",
-    "filesSub": "Management-dir tar · download needs login · restore: dry-run / web / full",
+    "filesSub": "Archives live in the panel data directory. Download needs a login. Restore can preview, restore the site only, or restore everything.",
     "backupAllBtn": "Backup all",
     "yes": "Yes",
     "no": "No",
@@ -419,7 +442,20 @@
     "remotePushSub": "After local tar succeeds, push to SFTP, local path, or S3",
     "accessKey": "Access Key",
     "secretKey": "Secret Key",
-    "overwriteConfirmHint": "Type OVERWRITE to confirm overwrite"
+    "overwriteConfirmHint": "Type OVERWRITE to confirm overwrite",
+    "testRemote": "Test destination",
+    "testRemoteHint": "Connects to the remote host and writes a small probe file. Not read-only.",
+    "testRemoteDone": "Remote probe finished",
+    "testRemoteFailed": "Remote probe failed",
+    "resticRepoPh": "Panel data directory / restic-repo",
+    "testDisabledHint": "Turn on remote push before testing.",
+    "identityId": "Outbound SSH identity",
+    "identityHint": "Preferred. Same vault as /security SSH. Password needs sshpass.",
+    "identityNone": "None — password or default key",
+    "skippedListHint": "These projects were skipped:",
+    "skippedPendingOs": "Skipped — OS user / home not provisioned",
+    "goLogs": "Open logs",
+    "goAbout": "Backup notes"
   },
   "btTracker": {
     "title": "BT Tracker",
@@ -431,11 +467,19 @@
     "installed": "Installed",
     "start": "Start",
     "stop": "Stop",
+    "stopTitle": "Stop the tracker — seeding and downloads will interrupt",
+    "stopDesc": "Running torrents stop announcing. Peers disconnect until you start the tracker again.",
+    "fillPublicHost": "Use {{host}}",
+    "fillPublicHostTitle": "Fill the current panel hostname as the public announce host",
     "refresh": "Refresh",
     "settings": "Settings",
     "httpPort": "HTTP / WS port",
     "udpPort": "UDP port",
     "listenHost": "Listen",
+    "listenHostHint": "0.0.0.0 listens on every address. Prefer 127.0.0.1 unless peers must reach this host.",
+    "listenAllWarn": "Tracker is bound to all addresses. With the firewall off this is public. Bind 127.0.0.1 for local-only, or restrict the port in the firewall.",
+    "bindLoopback": "127.0.0.1 only",
+    "bindAll": "0.0.0.0 (all)",
     "wsEnabled": "WebSocket",
     "wsEnabledHint": "",
     "autostart": "Autostart",
@@ -444,12 +488,14 @@
     "publicAnnounceHostHint": "",
     "maxSeeds": "Max seeds",
     "seederPorts": "Peer ports",
-    "seederPortsHint": "",
+    "seederPortMin": "Peer port start",
+    "seederPortMax": "Peer port end",
+    "seederPortsHint": "Inclusive range used by the local seeder (typically 6881–6889).",
     "saveSettings": "Save",
     "applyHint": "",
     "torrents": "Torrents",
     "torrentsEmpty": "No torrents",
-    "torrentsEmptyHint": "Create a BT share in Files",
+    "torrentsEmptyHint": "Add a .torrent, or create a BT share in Files",
     "torrentsDesc": "",
     "colName": "Name",
     "colHash": "Hash",
@@ -461,8 +507,13 @@
     "copy": "Copy",
     "copied": "Copied",
     "statsTorrents": "Torrents",
+    "statsLibrary": "Library",
+    "statsLibraryHint": "Torrents in the panel library / file shares",
+    "statsTrackerLeftover": "Leftover (not in library)",
+    "statsTrackerLeftoverHint": "Hashes the local tracker has announced that are not torrent-library rows. Extra announce URLs are on the Trackers tab.",
     "statsPeers": "Peers",
     "statsAnnounces": "Announces",
+    "statsAnnouncesHint": "Announce requests seen by the tracker process",
     "statsJobs": "Jobs",
     "openShares": "Shares",
     "needExecute": "YSK_EXECUTE required to bind ports",
@@ -538,7 +589,71 @@
     "udpPortSameHttp": "Same HTTP ({{port}})",
     "udpPortClassic": "6969",
     "portSuggest8000": "8000",
-    "announceHostUnset": "—"
+    "announceHostUnset": "Not set",
+    "tabTrackers": "Trackers",
+    "addTorrent": "Add torrent",
+    "addTorrentTitle": "Add torrent",
+    "addTorrentHint": "Upload a .torrent or paste a magnet. Choose a Files folder. WebTorrent downloads missing files and seeds when complete.",
+    "dropTorrent": "Drop a .torrent here",
+    "chooseFile": "or choose a file",
+    "magnetLabel": "Magnet",
+    "magnetPlaceholder": "magnet:?xt=urn:btih:…",
+    "inspect": "Read",
+    "extraTrackersPreview": "Will also announce to {{n}} extra tracker(s)",
+    "saveLocation": "Save location",
+    "saveRootPublic": "Public files",
+    "newFolder": "New folder",
+    "destPreview": "Will write to",
+    "startDownload": "Start download",
+    "filterDownloading": "Downloading",
+    "filterPaused": "Paused",
+    "filterError": "Error",
+    "emptyDrop": "Drop a .torrent here, or choose a file",
+    "emptyHint": "Files go in the folder you pick. If they are already complete, this host seeds. Engine: WebTorrent — no extra download software.",
+    "pause": "Pause",
+    "resume": "Resume",
+    "openFolder": "Open folder",
+    "remove": "Remove",
+    "removeKeep": "Remove, keep files",
+    "removeDelete": "Remove and delete files",
+    "removeConfirm": "Remove this torrent from the library?",
+    "kindShare": "Share",
+    "filesInTorrent": "files",
+    "extraTrackersDesc": "Extra announce URLs. Library download/seed and file-share seeds use them in addition to the .torrent list. This does not open the local tracker to arbitrary swarms.",
+    "extraTrackersEmpty": "No extra trackers. Add HTTP(S), UDP, or WS(S) announce URLs so this host can find peers.",
+    "extraTrackerAdd": "Add",
+    "extraTrackerUrl": "Announce URL",
+    "extraTrackerApply": "Apply to current seeds",
+    "extraTrackerApplyOk": "Applied extra trackers",
+    "extraEnabled": "On",
+    "extraTrackerBad": "URL must start with http://, https://, udp://, ws://, or wss://",
+    "extraTrackerDup": "Already listed",
+    "extraTrackerLimit": "Maximum 32 extra trackers",
+    "addOk": "Added to library",
+    "savedTo": "Save",
+    "folderEmpty": "No subfolders",
+    "needTorrentFile": "Choose a .torrent file",
+    "torrentTooBig": ".torrent larger than 8 MiB",
+    "seedStatusDownloading": "Downloading",
+    "seedStatusChecking": "Checking",
+    "seedStatusPaused": "Paused",
+    "seedStatusQueued": "Queued",
+    "swarmLeftover": "Tracker has {{count}} announce(s) not in the library",
+    "addSourceSection": "Source",
+    "addSourceFile": "File",
+    "addSourceMagnet": "Magnet",
+    "previewSection": "Preview",
+    "saveRoot": "Root",
+    "clearFile": "Clear file",
+    "extraTrackersTitle": "Extra announce",
+    "extraTrackersEmptyTitle": "No extra trackers yet",
+    "extraEnabledCount": "{{count}} enabled",
+    "extraApplyHint": "Enable at least one tracker to apply to current seeds",
+    "destMode": "How to use this folder",
+    "seedExisting": "Seed existing files",
+    "downloadNewFolder": "Download into a new folder",
+    "destFileConflict": "A file named {{name}} already exists here. Pick another folder, or seed the existing file if it matches.",
+    "waitingPeers": "Waiting for peers. If the files are already on this host, add again and choose Seed existing files."
   },
   "catalog": {
     "sw": {
@@ -604,8 +719,58 @@
     "confWritten": "Conf written ({{status}})",
     "partialFail": "Not fully successful ({{status}}) — see notes",
     "statNodes": "Nodes",
+    "hitNoStats": "No edge stats yet",
+    "loopbackOriginBlocked": "Will not apply loopback origin {{url}} to a remote edge. Set a reachable origin first.",
+    "applyFailedHint": "Apply failed — see notes below",
+    "applyStatus": {
+      "draft": "Draft",
+      "planned": "Planned",
+      "applying": "Applying",
+      "applied": "Applied",
+      "failed": "Failed",
+      "partial": "Partial"
+    },
     "statSites": "Sites",
+    "pillNodesSites": "{{n}} nodes · {{s}} sites",
+    "statOnline": "Online",
+    "statHit": "Hit rate",
+    "hitUnknown": "Unknown",
+    "lastHealthHint": "Last probe {{at}} · {{ok}}",
+    "lastHealthNever": "Not probed yet — run Probe",
+    "lastHealthFail": "probe failed",
+    "healthLoopNeedSites": "Add a site first",
+    "nodeStatus": {
+      "online": "online",
+      "offline": "offline",
+      "draining": "draining",
+      "unknown": "unknown"
+    },
     "recentNotes": "Recent notes",
+    "previewOnlyNote": "Preview only — nothing was written to the edges.",
+    "statByRegion": "Region: ",
+    "statByApply": "Apply status: ",
+    "col": {
+      "origin": "Origin",
+      "edges": "Edges",
+      "apply": "Apply",
+      "dns": "DNS",
+      "edgesOnline": "Edges online / applied",
+      "dnsRr": "CDN DNS records"
+    },
+    "mode": {
+      "origin_pull": "Origin pull",
+      "reverse_proxy": "Reverse proxy",
+      "static_edge": "Static edge"
+    },
+    "dnsStrategy": {
+      "multi_a": "Multiple A records",
+      "cname": "CNAME",
+      "geo": "Geo"
+    },
+    "edgesOnlineApplied": "{{online}}/{{total}} online · {{applied}} applied",
+    "hitMiss": "Hits {{hits}} / misses {{misses}}",
+    "cacheBytes": "Cache ≈ {{n}} B",
+    "hitRateUnknown": "No access log with cache status and no cache directory, so hit rate cannot be estimated.",
     "edgeConfPreview": "Nginx edge conf preview",
     "tabs": {
       "nodes": "Nodes",
@@ -614,11 +779,41 @@
       "about": "About"
     },
     "nodesTitle": "CDN nodes ({{count}})",
-    "nodesDesc": "Register control / origin / edge / dns. Probe updates status.",
+    "nodesDesc": "Register control-plane, origin, edge, and DNS nodes. Probe refreshes status.",
+    "offlineHint": "Offline — probe failed. Remove the node if it is leftover.",
     "colName": "Name",
     "colRole": "Role",
     "colStatus": "Status",
     "clearDrain": "Clear drain",
+    "drain": "Drain",
+    "drainTitle": "Stop sending new CDN traffic to this edge",
+    "drainDesc": "Drain “{{name}}”? Existing connections stay until they finish.",
+    "drainLastTitle": "This is the last edge — drain will leave every site without an edge",
+    "drainLastDesc": "“{{name}}” is the only edge. Drain it and all sites have no edge.",
+    "clearDrainTitle": "Accept new traffic on this edge again",
+    "clearDrainDesc": "Clear drain on “{{name}}”?",
+    "deleteNodeTitle": "Delete this CDN edge",
+    "deleteLastNodeTitle": "Delete the last edge — all sites will have no edge",
+    "purge": "Purge",
+    "previewTitle": "Preview nginx config (no write)",
+    "writeConfTitle": "Write edge nginx config files",
+    "applyEdgesTitle": "Apply this site to edges (writes nginx)",
+    "purgeTitle": "Purge cache on edges",
+    "dnsSyncTitle": "Write CDN DNS records",
+    "probeDnsTitle": "Probe edges and DNS (read-only)",
+    "distSslTitle": "Copy TLS materials to edges",
+    "leIssueTitle": "Issue a Let’s Encrypt certificate and distribute it",
+    "deleteSiteTitle": "Delete this CDN site",
+    "siteOpConfirmGeneric": "Run this action on “{{name}}”?",
+    "siteOpConfirmDesc": "Site “{{name}}” · {{action}}. This can change nginx, DNS, or certificates.",
+    "siteOpConfirm": {
+      "apply": "Apply this site to edges?",
+      "render": "Write nginx config for this site?",
+      "purge": "Purge cache for this site?",
+      "dns-sync": "Sync DNS for this site?",
+      "dist": "Distribute TLS to edges?",
+      "issue": "Issue Let’s Encrypt and distribute?"
+    },
     "emptyNodesTitle": "No CDN nodes yet",
     "emptyNodesDesc": "Use “+ Add node” to register an edge, then create sites.",
     "sitesTitle": "CDN sites ({{count}})",
@@ -689,7 +884,13 @@
     "deleteNodeDesc": "Deletes CDN node \"{{name}}\".",
     "deleteSiteDesc": "Deletes CDN site \"{{name}}\".",
     "deleteSiteC1": "Site policy and edge associations",
-    "deleteSiteC2": "Applied nginx configs may need separate cleanup or re-apply"
+    "deleteSiteC2": "Applied nginx configs may need separate cleanup or re-apply",
+    "statOnlineOf": "Online {{n}}/{{total}}",
+    "colRegion": "Region",
+    "statDraining": "Draining {{n}}",
+    "statOffline": "Offline {{n}}",
+    "localTest": "local / test",
+    "statHitRate": "Hit rate {{v}}"
   },
   "cli": {
     "unknownCommand": "Unknown command: {{command}}\nRun `{{cli}} help`",
@@ -705,7 +906,7 @@
     },
     "help": {
       "blurb": "Control plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json",
-      "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones (AI alias → hosting dns-*)\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume (full host migrate)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH\n  --config PATH\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
+      "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
     },
     "usage": {
       "tools": {
@@ -1295,7 +1496,7 @@
           "--name": {
             "name": {
               "--domain": {
-                "66e857": "Usage: ysk-server projects create --name <name> [--domain d] [--runtime node|php|static|python|go|rust] [--template id]\n"
+                "66e857": "Usage: ysk-server projects create --name <name> [--domain d] [--runtime node|php|static|python|go|rust] [--template id] [--git-url URL] [--branch B] [--create-dns] [--create-mail] [--server-ip A.B.C.D] [--server-ipv6 ADDR]\n"
               }
             }
           }
@@ -1313,7 +1514,7 @@
           "--id": {
             "id": {
               "--git-url": {
-                "a513f5": "Usage: ysk-server projects git-deploy --id ID [--git-url URL] [--branch main] [--no-redeploy] [--depth 1] [--entry f]\n"
+                "a513f5": "Usage: ysk-server projects git-deploy --id ID [--git-url URL] [--branch|--ref main] [--no-redeploy] [--depth 1] [--entry f]\n"
               }
             }
           }
@@ -1331,7 +1532,7 @@
           "get": {
             "create": {
               "deploy": {
-                "253b48": "Usage: ysk-server projects list|get|create|deploy|git-deploy|stop|backup|template|health [options]\n  deploy --id UUID [--entry f] [--port N] [--fpm|--builtin] [--reload]\n  git-deploy --id UUID [--git-url URL] [--branch B] [--no-redeploy]\n"
+                "253b48": "Usage: ysk-server projects list|get|create|deploy|git-deploy|git|stop|backup|template|ftp|health [options]\n  deploy --id UUID [--entry f] [--port N] [--fpm|--builtin] [--reload]\n  git-deploy --id UUID [--git-url URL] [--branch|--ref B] [--no-redeploy]\n  git status|log|fetch|checkout|reset|auth|hook|deploy --id UUID [--ref R] [--unshallow] [--yes]\n  git auth --id UUID --token T|--deploy-key|--pin-host\n  git hook --id UUID --enable|--rotate|--disable\n  ftp --id UUID --password P [--user NAME] [--home app|root]\n"
               }
             }
           }
@@ -1575,7 +1776,7 @@
             },
             "status": {
               "bans": {
-                "a8d96b": "Usage: {{CLI_NAME}} defense status|bans|suspects|ban|unban|whitelist|stack-apply|fail2ban|firewall|timeline|presets [--json]\n` +\n          `  bans [--q text] [--source fail2ban|panel|ufw|auto]\n` +\n          `  suspects [--q text]\n` +\n          `  stack-apply [--execute]   # UFW + fail2ban + current preset\n` +\n          `  fail2ban | firewall       # deep probes (honest)\n` +\n          `  timeline [--limit N] [--q text]\n` +\n          `  presets                   # list + activePreset\n"
+                "a8d96b": "Usage: {{CLI_NAME}} defense status|bans|suspects|ban|unban|whitelist|stack-apply|fail2ban|firewall|timeline|presets [--json]\n  bans [--q text] [--source fail2ban|panel|ufw|auto]\n  suspects [--q text]\n  stack-apply [--execute]   # UFW + fail2ban + current preset\n  fail2ban | firewall       # deep probes (honest)\n  timeline [--limit N] [--q text]\n  presets                   # list + activePreset\n"
               }
             }
           }
@@ -1597,7 +1798,7 @@
           "--username": {
             "u": {
               "--password": {
-                "7145c7": "Usage: ysk-server users create --username <u> --password <p> [--role operator|viewer|admin] [--package-id id]\n"
+                "7145c7": "Usage: ysk-server users create --username <u> --password <p> [--role operator|viewer|admin] [--package-id id] [--locale zh-HK]\n"
               }
             }
           }
@@ -1741,7 +1942,7 @@
         }
       },
       "x": {
-        "972912": "Usage:\n  ysk-server migrate inventory [--data-dir PATH] --json\n  ysk-server migrate host --target root@IP [--identity-file PATH|--identity-id ID|--password PW] --execute [--maintenance] [--force-wipe-target]\n  ysk-server migrate post --job ID --data-dir PATH --execute   # on target\n  ysk-server migrate status [--job ID]\n  ysk-server migrate resume --job ID --execute\n"
+        "972912": "Usage:\n  ysk-server migrate inventory [--data-dir PATH] --json\n  ysk-server migrate host --target root@IP [--identity-file PATH|--identity-id ID|--password PW] --execute [--maintenance] [--force-wipe-target]\n  ysk-server migrate post --job ID --data-dir PATH --execute   # on target\n  ysk-server migrate status [--job ID]\n  ysk-server migrate resume --job ID --execute\n  ysk-server migrate orphan-homes [--data-dir PATH] --json\n  ysk-server migrate orphan-homes --path /home/ysk-server-UUID --confirm PATH --execute\n"
       },
       "hostingHelp": "Usage: ysk-server hosting <sub>\n  Dangerous ops default dry-run; add --execute (+ YSK_EXECUTE=1) to apply\n  nginx | nginx-sync [--execute]\n  redis-provision | postgres-provision | mysql-provision [--execute]\n  dns-zone --zone X --ip A.B.C.D [--ipv6 X:X::X] [--validate] [--reload]\n  dns-zones | powerdns-status | powerdns-install [--install|--execute]\n  powerdns-load --zone X --ip A.B.C.D [--load|--execute]\n  email-apply --domain X [--install|--execute]\n  email-mailbox --domain X --local user [--password P] [--ip A.B.C.D] [--system]\n  ftps-apply --domain X [--install|--execute]\n  runtimes | runtime-install --kind node|php|python|go|rust --version V [--install|--execute]\n  dovecot-passdb --domain X | --all\n  webmail-apply --domain webmail.example.com [--download]\n  public-files --domain files.example.com [--reload]\n  email-bootstrap --domain example.com --ip A.B.C.D [--install|--execute]\n  email-deliverability --domain example.com   # PTR/DNSBL/warmup pack (honest)\n  firewall-apply [--smtp] [--execute]\n",
       "logsQuery": "Usage: {{CLI_NAME}} logs query --source <id> [--lines N] [--grep G] [--since 1h] [--priority err]\n  source examples: journal:  journal:nginx.service  file:syslog  project:<uuid>\n  {{CLI_NAME}} logs sources --json\n  {{CLI_NAME}} logs journal [--unit nginx.service] --json\n"
@@ -1874,6 +2075,7 @@
     }
   },
   "common": {
+    "all": "All",
     "cancel": "Cancel",
     "confirm": "Confirm",
     "refresh": "Refresh",
@@ -1896,9 +2098,12 @@
     "languageNative": "English",
     "language": "Language",
     "switchLanguage": "Switch language",
+    "showPassword": "Show",
+    "hidePassword": "Hide",
     "searchGlobal": "Search pages & resources…",
     "menu": "Menu",
     "processing": "Working…",
+    "unavailable": "Not available right now",
     "retry": "Retry",
     "success": "Success",
     "failed": "Failed",
@@ -1910,7 +2115,9 @@
     "noData": "No data",
     "input": "Input",
     "pleaseEnter": "Enter {{value}}",
+    "required": "Required",
     "about": "About",
+    "more": "More",
     "operation": "Actions",
     "delete": "Delete",
     "edit": "Edit",
@@ -1996,7 +2203,8 @@
     "show": "Show",
     "done": "Done",
     "next": "Next",
-    "previous": "Previous"
+    "previous": "Previous",
+    "redirectedTo": "Opened {{to}} (was {{from}})"
   },
   "cron": {
     "presetCdTrue": "cd app + true (test)",
@@ -2135,9 +2343,44 @@
     "sourceHost": "Host",
     "noHostJobs": "No crontab jobs in this scope",
     "hostPartial": "Could not read every user crontab (root required)",
-    "pendingInstall": "Pending install ({{count}})"
+    "pendingInstall": "Pending install ({{count}})",
+    "hourRange": "Hour must be 0–23.",
+    "minuteRange": "Minute must be 0–59.",
+    "hoursCommon": "Common hours",
+    "hoursAll": "All hours",
+    "invalidExpr": "Not a valid 5-field cron expression.",
+    "needCommand": "Command is required.",
+    "needUser": "Choose a project or a system user.",
+    "hostCounts": "Host lines",
+    "hostCountsVal": "{{ysk}} · other {{other}} · total {{total}}",
+    "hostYskYes": "panel lines present",
+    "hostYskNo": "no panel lines",
+    "emptyHostCrontab": "No crontab for {{user}}.",
+    "writtenOnHost": "Written",
+    "registeredJobsChip": "Registered",
+    "registeredVsWritten": "Registered in the panel vs written to host crontab",
+    "installPreviewTitle": "Preview before installing to system crontab",
+    "installPreviewDesc": "This merges the YSK block into the host crontab. Existing non-YSK lines stay.",
+    "installPreviewMerge": "Install writes a YSK Server crontab merge block. It does not replace the whole crontab.",
+    "installPreviewEmpty": "No pending managed jobs — install still refreshes the YSK block.",
+    "editJobTitle": "Edit job",
+    "editJobDesc": "Changes stay in the panel until you install to the system crontab.",
+    "saveJob": "Save (management only)",
+    "panelLines": "Panel lines",
+    "otherLines": "Other lines",
+    "totalLines": "Total",
+    "writtenOnHostHint": "Lines already written to the host crontab",
+    "registeredJobsHint": "Jobs registered in the panel (including pending install)",
+    "pendingInstallCount": "{{n}} pending install",
+    "systemJobBadge": "No project · system user"
   },
   "dashboard": {
+    "serviceAria": "{{name}}: {{state}}",
+    "sev": {
+      "ok": "OK",
+      "warn": "Warning",
+      "bad": "Problem"
+    },
     "title": "Dashboard",
     "health": "Health",
     "protection": "Protection mode",
@@ -2194,7 +2437,8 @@
     "warnCount": " · warn {{count}}",
     "applyAuditBadge": "Apply audit · ok {{ok}} · warn {{warn}} · bad {{bad}}",
     "executeBadge": "EXECUTE {{state}}",
-    "executeLabel": "EXECUTE",
+    "executeLabel": "System change",
+    "publicNo2fa": "This panel listens on all interfaces and your admin account has no 2FA.",
     "go": "Open",
     "open": "Open",
     "noCriticalWarn": "No critical or warning alerts",
@@ -2224,29 +2468,41 @@
     "runtime": "Runtime",
     "runtimeHint": "Sets default runtime version and deploy style",
     "runtimeVersion": "Runtime version",
-    "versionHint": "Stored as project runtime_version",
+    "versionHint": "Writes the project runtime version setting",
     "serverIpv4": "Server IPv4",
     "serverIpv4Hint": "DNS A / mail SPF",
     "serverIpv4Ph": "This host public IPv4",
     "serverIpv6": "Server IPv6 (optional)",
     "serverIpv6Hint": "Writes AAAA / ip6: when set",
     "serverIpv6Ph": "Public IPv6 (optional)",
+    "needDomainFirst": "Enter a domain first",
     "withDns": "Also create DNS zone",
     "withDnsDesc": "Needs domain; registration only — apply zone on DNS page",
     "withMail": "Also register mail domain",
     "withMailDesc": "Needs domain; install software & DNS on mail detail page",
-    "withDb": "Also draft MySQL database",
-    "withDbDesc": "Control-plane registration; apply on SQL engine page",
+    "withDb": "Also draft a database",
+    "withDbDesc": "Control-plane registration; apply on the SQL engine page",
     "wizardHint": "Quick create does not go live automatically",
     "wizardSubmit": "Create",
     "wizardOk": "Created",
     "wizardPartial": "Partially failed",
     "notifCenterTitle": "Notifications ({{count}})",
     "notifCenterDesc": "Critical {{critical}} · warn {{warn}} · info {{info}}",
-    "noNotifs": "No notifications",
+    "noNotifs": "No notifications. Recent audit events are on Overview.",
     "noNotifsDesc": "System alerts and todos appear here",
     "applyAuditTitle": "Apply status audit",
-    "applyAuditDesc": "ok {{ok}} · warn {{warn}} · bad {{bad}}"
+    "applyAuditDesc": "ok {{ok}} · warn {{warn}} · bad {{bad}}",
+    "barTitle": "{{count}} host alert(s)",
+    "levelCritical": "Critical",
+    "levelWarn": "Warning",
+    "levelInfo": "Info",
+    "colTitle": "Alert",
+    "colDetail": "Detail",
+    "colSource": "Source",
+    "notifSearch": "Search alerts",
+    "notifAll": "All",
+    "notifDismiss": "Hide",
+    "goFix": "Fix"
   },
   "dataTable": {
     "empty": "No data",
@@ -2306,12 +2562,26 @@
     "emptyDbInstallFirst": "Install {{engine}} via the banner, then Create database",
     "emptyDbCannotProvision": "Cannot create databases on the server right now",
     "emptyDbCreateHint": "Use Create database, then Apply",
+    "emptyDbHostHasRows": "The host already has databases that are not in this control-plane list.",
+    "registeredVsHostHint": "Registered in the panel / found on the host",
+    "registeredCount": "Registered",
+    "hostCount": "On host",
+    "registeredUsers": "Registered users",
+    "registeredUsersHint": "Panel registrations only — not every MySQL account",
+    "hostStillExists": "Still on host",
+    "expiresLabel": "Expires",
+    "dumpNeedRegistered": "Register a database in the panel first",
+    "dumpFirstDbTitle": "Export the first registered database",
+    "importNeedRegistered": "Register a database in the panel first",
+    "importLatestNeedConfirm": "Needs confirmation — imports into the registered database",
+    "hostHasUntracked": "{{count}} host databases are not registered in the panel",
+    "hostInventoryHint": "The table is control-plane rows only. Live names come from SHOW DATABASES.",
     "userList": "Users",
     "userListDesc": "Grant users access to databases",
     "createUserBtn": "+ Create user",
     "noUsersYet": "No users yet",
     "tempReadonlyUsers": "Temporary read-only users",
-    "tempReadonlyDesc": "Control plane marks expired after TTL;",
+    "tempReadonlyDesc": "Expired accounts are dropped from the server when this page loads (needs EXECUTE + root). Rows left below still exist on the host.",
     "dbName": "Database name",
     "ttlHours": "TTL (hours)",
     "ttlHoursHint": "Marked invalid after expiry",
@@ -2320,7 +2590,14 @@
     "expiresAt": "Expires",
     "revokeRegistration": "Revoke registration",
     "remoteDbHosts": "Remote database hosts",
-    "remoteDbHostsDesc": "Register connection targets (password not echoed back)",
+    "remoteDbHostsDesc": "Register connection targets (password not echoed back). Saved ≠ reachable until Test connection.",
+    "remoteTest": "Test connection",
+    "remoteTestDone": "Remote host probe finished",
+    "remoteTestOk": "reachable",
+    "remoteTestFail": "unreachable",
+    "remoteNotChecked": "not tested",
+    "remoteDeleteTitle": "Remove this registration only",
+    "remoteDeleteConfirm": "Remove registration {{name}}? The remote server is not changed.",
     "displayName": "Display name",
     "prodReplicaPlaceholder": "Production replica",
     "remoteHostSaved": "Remote host saved",
@@ -2345,7 +2622,7 @@
     "import": "Import",
     "importOk": "Import complete",
     "importFailed": "Import failed",
-    "deleteDbTitle": "Delete database registration?",
+    "deleteDbTitle": "Remove control-plane registration (does not DROP the server database)",
     "deleteDbDesc": "Removes control-plane record only; does not DROP the server database.",
     "deleteUserTitle": "Delete user registration?",
     "deleteUserDesc": "Removes control-plane record only.",
@@ -2374,8 +2651,11 @@
     "update": "Update",
     "alsoCreateRole": "Also create role",
     "cluster": {
+      "standaloneOtherEngines": "This engine is standalone. Other engines have clusters: {{names}}.",
+      "roleUnassigned": "No role assigned",
       "title": "Cluster",
-      "description": "Plan → write management → apply → probe → peer distribute / fleet. Default dry-run.",
+      "description": "Plan → write management files → apply → probe → distribute to peers / fleet. Default is dry-run (no host restart).",
+      "redirectedFromCluster": "You were redirected here from /cluster. This is the database cluster tab.",
       "kindGalera": "Simple Galera",
       "kindMysqlReplica": "MySQL primary/replica",
       "kindPgReplica": "PostgreSQL streaming replica",
@@ -2404,10 +2684,37 @@
       "registrationDeleted": "Registration deleted",
       "nodes": "Nodes",
       "remoteInstallPlan": "Remote install plan",
+      "fleetSession": "Fleet agent session id",
+      "fleetSessionHint": "Optional. Pick a registered fleet session (uses fleet, not SSH). Leave empty for SSH scp.",
+      "fleetSessionPh": "Agents page session UUID",
+      "fleetSessionNone": "None — use SSH",
+      "fleetSessionOpenAgents": "Open /agents to register a session",
+      "createWizardTitle": "Opens the plan wizard. Needs a local IP and ≥1 peer. Writes panel artifacts only (dry-run). Does not restart the engine until you apply.",
+      "bootstrap": "Bootstrap",
+      "fleetApply": "Fleet apply",
+      "planTitle": "Regenerate the cluster plan (no host change)",
+      "writeFileTitle": "Write management files under the panel data dir (dry-run)",
+      "probeLocalTitle": "Probe this host only",
+      "probeAllTitle": "Probe every registered member",
+      "bootstrapTitle": "Install local drop-in and bootstrap the first node",
+      "remoteInstallPlanTitle": "Preview remote install (no execute)",
+      "downloadBundleTitle": "Download peer conf bundle (.tar.gz)",
+      "pushPlanTitle": "Preview push to peer (no scp)",
+      "fleetSyncPlanTitle": "Preview fleet sync (no execute)",
+      "fleetApplyTitle": "Enqueue apply on fleet members?",
+      "status": {
+        "healthy": "Healthy",
+        "planned": "Planned",
+        "partial": "Partial",
+        "failed": "Failed",
+        "draft": "Draft",
+        "degraded": "Degraded",
+        "applied": "Applied"
+      },
       "fleetSyncPlan": "Fleet sync plan",
       "standaloneTitle": "Currently: standalone",
       "standaloneRepl": "No replica registered. Set primary/master + replica to generate conf and scripts.",
-      "standaloneHa": "No HA registered. Add peer nodes to generate conf plan, then bootstrap / join.",
+      "standaloneHa": "No HA registered. Add at least one peer, generate a conf plan, then bootstrap the first node and join the others.",
       "recentProbe": "Recent probe (local wsrep)",
       "probeRequired": "healthy requires a passing probe",
       "planPreview": "Plan preview",
@@ -2454,6 +2761,7 @@
       "remoteInstalled": "Remote installed",
       "fleetSynced": "Fleet sync queued",
       "fleetApplyQueued": "Fleet apply queued",
+      "engineNotInstalled": "{{engine}} is not installed on this host — install it first, or open the engine that is actually running.",
       "plan": "Plan",
       "writeFile": "Write files",
       "applyLocal": "Apply local",
@@ -2470,8 +2778,7 @@
       "delete": "Delete",
       "probe": "Probe",
       "name": "Name",
-      "type": "Type",
-      "status": "Status"
+      "type": "Type"
     },
     "console": {
       "dataBrowse": "Browse data",
@@ -2479,6 +2786,7 @@
       "realtime": "Live",
       "reload": "Reload",
       "needRestart": "Restart required",
+      "affectsProjects": "Sites and services that use this engine will be interrupted.",
       "lifecycle": "Lifecycle",
       "overview": "Overview",
       "actionDone": "{{action}} done",
@@ -2510,10 +2818,10 @@
       "installEngine": "Use the banner above to install {{title}}.",
       "reloadConfig": "Reload config",
       "disableBoot": "Disable on boot",
+      "disableBootConfirm": "The engine will not start after reboot until you enable it again.",
       "needRights": "Needs system-change rights and admin. Failures show reasons — never fake success.",
       "noneFetched": "— none —"
     },
-    "expiresLabel": "Expires",
     "importEntry": "Entry: {{url}}",
     "adminerRiskFull": "Public Adminer is risky — restrict source IPs or add HTTP auth. Needs PHP-FPM socket (default php8.2).",
     "adminerWriteHintFull": "Write only = management written;",
@@ -2537,7 +2845,10 @@
     "unfreezeOk": "{{engine}} repair complete",
     "startAfterUnfreeze": "Start service (auto-runs repair plan on failure)",
     "serviceDownTitle": "Database service is down",
-    "serviceDownBody": "Service is unhealthy"
+    "serviceDownBody": "Service is unhealthy",
+    "adoptHostDb": "Register in panel (no create): {{name}}",
+    "adoptHostDbTitle": "Registers the name in the control plane only — does not change host data",
+    "cleanupExpiredTempUsersTitle": "Drops panel-issued temporary users that have expired"
   },
   "dialogs": {
     "confirmDefault": "Confirm",
@@ -2581,6 +2892,8 @@
     "zonesTitle": "Zones ({{count}})",
     "zonesDesc": "After create, write/apply the zone",
     "createZone": "+ Create zone",
+    "mailZonesMissing": "Email domains have no DNS zone here: {{domains}}.",
+    "createMailZone": "Create mail zone",
     "colZoneName": "Zone name",
     "colServerIp": "Server IP",
     "colTemplate": "Template",
@@ -2657,7 +2970,10 @@
     "validateDesc": "Create/edit auto-validates (CNAME clashes, A/AAAA format, etc.).",
     "createZoneTitle": "Create DNS zone",
     "createZoneDesc": "Generate records from a template",
+    "createZoneNeedValid": "Enter a valid zone name and IPv4 address",
     "zoneNameHint": "e.g. example.com (no trailing dot)",
+    "invalidZone": "Invalid zone name. Use a real domain (e.g. example.com).",
+    "invalidIpv4": "Invalid IPv4. Each octet must be 0–255.",
     "serverIpv4": "Server IPv4",
     "serverIpv4Hint": "Address used for template A records",
     "thisHostIpv4": "This host public IPv4",
@@ -2751,6 +3067,9 @@
     "lookupServer": "Server (@)",
     "lookupServerHint": "127.0.0.1 = local auth; public IP tests external; empty = system resolver",
     "healthHealPdns": "Heal PowerDNS bind",
+    "healNeedInstall": "PowerDNS is not installed — install it on the Software tab first",
+    "applyNeedService": "DNS service is not running — start or install it before apply",
+    "deleteZoneNeedName": "Delete this zone — you will type the zone name to confirm",
     "healthHealPdnsHint": "Set local-address to public IP to avoid clashing with systemd-resolved on 0",
     "healthHealPdnsOk": "PowerDNS bound to {{ip}} and start attempted",
     "healthHealPdnsFailed": "PowerDNS heal failed",
@@ -2761,7 +3080,264 @@
     "aboutHealthTitle": "Service health",
     "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
     "aboutStackTitle": "Software",
-    "aboutStackBody": "Check/update the PowerDNS package under Software."
+    "aboutStackBody": "Check/update the PowerDNS package under Software.",
+    "createMailZoneNow": "Created mail zone {{domain}}",
+    "toolsFirewallTitle": "Firewall (UFW)",
+    "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",
+    "toolsUnitTitle": "PowerDNS unit",
+    "toolsUnitHint": "systemd unit pdns — start, stop, restart, reload.",
+    "installConfirmTitle": "Install PowerDNS?",
+    "installConfirmDesc": "Installs pdns-server and writes the managed authoritative config. Needs root and YSK_EXECUTE=1.",
+    "installConfirmConsequence": "After install and start, PowerDNS will bind port 53.",
+    "installPort53Busy": "Something already listens on port 53. PowerDNS may fail to bind until that listener is stopped or healed.",
+    "installPort53BusyConsequence": "Heal bind or stop the other listener before expecting answers on port 53."
+  },
+  "docker": {
+    "title": "Docker",
+    "subtitle": "Install Docker Engine, then manage containers, images, volumes, and validator Compose stacks on this host.",
+    "refresh": "Refresh",
+    "notInstalled": "Docker Engine is not installed. Install docker.io and docker-compose-v2 from this page.",
+    "protected": "Protected",
+    "pruneConfirm": "Type PRUNE to confirm any prune",
+    "needEngineTitle": "Install Docker Engine first",
+    "stopEngineDesc": "This stops the Docker engine and all {{n}} container(s) on this host.",
+    "notInstalledValue": "Not installed",
+    "nameHint": "Letters, digits, underscore, dot, hyphen (max 128)",
+    "volPlaceholder": "my-data",
+    "netPlaceholder": "my-net",
+    "runPorts": "Publish ports",
+    "runPortsHint": "host:container per line, e.g. 8080:80",
+    "runEnv": "Environment",
+    "runEnvHint": "KEY=value per line",
+    "runRestart": "Restart policy",
+    "runNetwork": "Network",
+    "runVolumes": "Volumes",
+    "runVolumesHint": "volume:dest per line",
+    "runAdvancedHint": "For multi-service stacks use validator nodes or Compose files already on this host.",
+    "daemonConfirmTitle": "Apply daemon settings?",
+    "daemonConfirmDesc": "Writes daemon.json and restarts docker.service. All containers will be interrupted.",
+    "settingsHint": "Safe daemon.json subset only. Apply writes the file and restarts docker.service.",
+    "cli": {
+      "usage": "Usage: ysk-server docker status|ps|images|volumes|networks|df|logs|inspect|exec|start|stop|restart|rm|pull|run|prune|engine|compose [--image IMG] [--name N] [--preset version|help|hostname] [--bin BIN] [--project P] [--execute] [--json]"
+    },
+    "tab": {
+      "overview": "Overview",
+      "containers": "Containers",
+      "images": "Images",
+      "compose": "Compose",
+      "volumes": "Volumes",
+      "networks": "Networks",
+      "prune": "Prune",
+      "settings": "Settings",
+      "about": "About"
+    },
+    "col": {
+      "engine": "Engine",
+      "containers": "Containers",
+      "version": "Version",
+      "dataRoot": "Data root",
+      "disk": "Disk",
+      "validators": "Validator stacks",
+      "name": "Name",
+      "image": "Image",
+      "status": "Status",
+      "ports": "Ports",
+      "managed": "Managed",
+      "size": "Size",
+      "driver": "Driver",
+      "type": "Type",
+      "reclaimable": "Reclaimable"
+    },
+    "state": {
+      "up": "Active",
+      "down": "Stopped",
+      "running": "Running",
+      "exited": "Exited",
+      "restarting": "Restarting",
+      "restartingCount": "Restarting · {{n}} times",
+      "paused": "Paused",
+      "created": "Created",
+      "dead": "Dead",
+      "removing": "Removing",
+      "unknown": "Unknown"
+    },
+    "df": {
+      "images": "Images",
+      "containers": "Containers",
+      "volumes": "Local volumes",
+      "builder": "Build cache",
+      "other": "Other"
+    },
+    "actions": {
+      "start": "Start",
+      "stop": "Stop",
+      "restart": "Restart",
+      "remove": "Remove",
+      "logs": "Logs",
+      "inspect": "Inspect",
+      "exec": "Exec (version)",
+      "run": "Run image",
+      "pull": "Pull",
+      "up": "Up",
+      "down": "Down",
+      "createVolume": "Create volume",
+      "createNetwork": "Create network",
+      "pruneContainers": "Prune containers",
+      "pruneImages": "Prune images",
+      "pruneVolumes": "Prune volumes",
+      "pruneSystem": "System prune",
+      "startEngine": "Start engine",
+      "stopEngine": "Stop engine",
+      "restartEngine": "Restart engine",
+      "applyDaemon": "Apply daemon settings"
+    },
+    "empty": {
+      "containers": "No containers",
+      "images": "No images",
+      "compose": "No Compose projects",
+      "composeDesc": "Projects come from validator nodes or Compose files already on this host. This page does not accept arbitrary YAML uploads.",
+      "composeCta": "Open validator nodes",
+      "volumes": "No volumes",
+      "networks": "No networks"
+    },
+    "logs": {
+      "empty": "No log output.",
+      "follow": "Follow"
+    },
+    "deleteRunningWarn": "This container is still running or restarting. It will be force-removed.",
+    "settings": {
+      "logMaxSize": "Container log max size",
+      "liveRestore": "Live restore (keep containers if the daemon restarts)",
+      "mirrors": "Registry mirrors (one URL per line)",
+      "insecure": "Insecure registries (one host per line)"
+    },
+    "about": {
+      "body": "Docker is a first-class host service on YSK Server, like Nginx. Install via the panel (Ubuntu docker.io + docker-compose-v2). Validator nodes run as Compose projects named yskval-*.",
+      "honesty": "Host changes need root and YSK_EXECUTE=1. Dry-run is the default. This page manages Docker on one host; use external Kubernetes for cluster orchestration.",
+      "validators": "Open validator nodes"
+    },
+    "alerts": {
+      "daemonTitle": "Docker daemon is down",
+      "daemonBody": "The Docker engine is installed but docker.service is not active. Validator stacks cannot start."
+    },
+    "errors": {
+      "notInstalled": "Docker is not installed",
+      "daemonDown": "Docker daemon is not active",
+      "needCompose": "docker compose (v2 plugin) is required",
+      "badImage": "Invalid image reference",
+      "badName": "Invalid name",
+      "badPort": "Invalid port publish",
+      "badEnv": "Invalid environment variable",
+      "badVolume": "Invalid volume mount",
+      "badNetwork": "Invalid network",
+      "protectedNetwork": "Cannot remove a built-in Docker network",
+      "badRestart": "Invalid restart policy",
+      "badPrune": "Invalid prune scope",
+      "needPruneConfirm": "Volume or system prune requires confirm=PRUNE",
+      "badDaemon": "Invalid daemon setting",
+      "composeMissing": "Compose file for this project was not found",
+      "logsFailed": "Could not read container logs",
+      "mutateFailed": "Docker command failed",
+      "engineFailed": "Could not control docker.service",
+      "badExec": "Exec is limited to allowlisted binaries and presets (no shell, no TTY)",
+      "uninstallBusy": "Stop YSK-managed containers (including validator stacks) before uninstalling Docker"
+    },
+    "notes": {
+      "dryMutate": "Dry-run only. Pass --execute and YSK_EXECUTE=1 to change the host.",
+      "dryPrune": "Prune preview (not applied).",
+      "dryEngine": "Engine control is dry-run.",
+      "dryDaemon": "Would write /etc/docker/daemon.json and restart docker.service.",
+      "daemonWrote": "Wrote daemon.json",
+      "start": "Container started",
+      "stop": "Container stopped",
+      "restart": "Container restarted",
+      "remove": "Container removed",
+      "ran": "Container started from image",
+      "pulled": "Image pulled",
+      "exec": "Ran allowlisted exec",
+      "imageRemoved": "Image removed",
+      "volumeCreated": "Volume created",
+      "volumeRemoved": "Volume removed",
+      "networkCreated": "Network created",
+      "networkRemoved": "Network removed",
+      "pruned": "Prune finished",
+      "compose": {
+        "up": "Compose project started",
+        "down": "Compose project stopped",
+        "restart": "Compose project restarted",
+        "rm": "Compose project removed"
+      },
+      "engine": {
+        "start": "docker.service started",
+        "stop": "docker.service stopped",
+        "restart": "docker.service restarted"
+      }
+    },
+    "ui": {
+      "whatYouGet": "What this page does",
+      "whatYouGetLead": "Install Docker Engine once. After that you can run a single container, pull images, and see validator Compose stacks that already live on this host.",
+      "capEngine": "Engine",
+      "capEngineDesc": "One-click install of docker.io and docker-compose-v2. Start and stop docker.service here.",
+      "capWork": "Containers and images",
+      "capWorkDesc": "Pick a common image, pull it, run it, then read logs or inspect the container.",
+      "capStacks": "Validator stacks",
+      "capStacksDesc": "Multi-service stacks are validator Compose projects (yskval-*). This page does not accept YAML uploads.",
+      "cardEngine": "Engine",
+      "cardDisk": "Disk",
+      "cardWork": "On this host",
+      "compose": "Compose",
+      "cgroup": "cgroup",
+      "used": "Used",
+      "free": "Free",
+      "running": "Running",
+      "images": "Images",
+      "volumes": "Volumes",
+      "networks": "Networks",
+      "goImages": "Images",
+      "goValidators": "Validator nodes",
+      "imagePickHint": "Choose a common image. Use Other only when you need a different reference.",
+      "imageCustom": "Other",
+      "driver": "Driver",
+      "driverLocalOnly": "This panel creates local volumes only.",
+      "netDefaultDriver": "New networks use Docker’s default bridge driver.",
+      "pruneWhat": "What to remove",
+      "pruneAck": "I understand unused data will be deleted and cannot be restored",
+      "pruneAckDesc": "Volume and system prune cannot be undone. Stopped containers and unused images are removed for the selected scope.",
+      "pruneNow": "Prune now",
+      "useMirrors": "Use registry mirrors",
+      "useInsecure": "Allow insecure registries",
+      "publishPorts": "Publish ports to the host",
+      "attachVolume": "Attach a volume",
+      "setEnv": "Set environment variables",
+      "defaultNet": "Default",
+      "mountPath": "Mount path",
+      "restartNo": "Never",
+      "restartUnless": "Unless stopped",
+      "restartAlways": "Always",
+      "restartOnFail": "On failure",
+      "needAck": "Confirm before pruning",
+      "scopeContainers": "Stopped containers",
+      "scopeImages": "Unused images",
+      "scopeVolumes": "Unused volumes",
+      "scopeBuilder": "Build cache",
+      "scopeSystem": "Everything unused",
+      "noVolumesYet": "No volumes yet — create one on the Volumes tab first.",
+      "customPort": "Another host port",
+      "customPortHost": "Host port",
+      "customPortContainer": "Container port",
+      "pctUsed": "{{n}}% used",
+      "customPortHint": "1–65535. Example: 9090 → 80.",
+      "pickBridge": "Bridge network"
+    },
+    "deleteTitle": "Delete {{id}}",
+    "deleteDesc": "This cannot be undone.",
+    "deleteC1": "The resource is removed from this host.",
+    "deleteComposeVal": "This is a validator stack — the validator instance is also deleted.",
+    "pruneTitle": "Prune Docker resources",
+    "pruneDesc": "Type PRUNE to confirm. Unused data cannot be restored.",
+    "pruneC1": "Unused resources in the selected scope are deleted.",
+    "pruneC2": "Volume and system prune permanently delete unused data volumes.",
+    "pruneC3": "Stopped containers or unused images in this scope are removed."
   },
   "email": {
     "title": "Email",
@@ -2806,13 +3382,16 @@
     "webmailMovedHint": "Webmail is configured globally (not per domain).",
     "openGlobalWebmailSettings": "Open webmail settings",
     "domainsTitle": "Domains ({{filtered}}/{{total}})",
+    "domainsListDesc": "Mail domains registered on this host",
     "emptyFilterHint": "No domains match the search",
     "emptyCreateHint": "Use Create in the toolbar to register a domain;",
     "queueLocalTitle": "Mail queue",
     "needExecute": "Needs YSK_EXECUTE",
     "viewQueue": "View queue",
     "flushQueue": "Flush queue",
-    "queueHint": "Click View queue to read the local Postfix queue",
+    "flushQueueEmpty": "Queue is empty",
+    "flushQueueNeedExecute": "Flushing the queue needs YSK_EXECUTE (host execute permission)",
+    "queueHint": "Local Postfix queue. Viewing is a read probe; flush needs YSK_EXECUTE.",
     "deleteThisId": "Delete this ID",
     "queueEmpty": "No deferred mail",
     "queueEmptyHint": "No deferred messages",
@@ -2834,7 +3413,8 @@
     "opsHost": "Host provider: PTR, Port 25 outbound policy",
     "opsRegistrar": "Registrar: publish MX / SPF / DKIM / DMARC",
     "statusTitle": "Status",
-    "statusDraft": "draft: panel only",
+    "statusDraft": "Draft (panel only)",
+    "deliverabilityChecks": "Checks",
     "statusWritten": "written: management files written, may not be live",
     "statusApplied": "applied: successfully applied before (still check service is-active)",
     "statusReputation": "Inbox reputation can never be 100% automated",
@@ -2870,6 +3450,14 @@
     "copyAllRecords": "Copy all records",
     "openDnsPage": "Open DNS page",
     "healthScore": "Health score",
+    "healthUnchecked": "Not checked yet",
+    "healthUncheckedHint": "Live DNS / PTR / port 25 have not been probed yet.",
+    "deliverabilityScore": "Deliverability pack",
+    "opendkimNoReload": "OpenDKIM has no reload — use restart after key or table changes.",
+    "opendkimNoReloadTitle": "systemctl reload opendkim is not supported on this stack",
+    "healthChecklist": "Checklist {{score}}/100",
+    "healthChecklistHint": "Checklist score — live DNS / PTR / port 25 not probed yet",
+    "healthLiveHint": "Live probe score",
     "suggestedRecords": "Suggested records",
     "externalTodosCount": "External todos",
     "colType": "Type",
@@ -2954,7 +3542,7 @@
     "hourlyMsgCap": "Hourly message cap",
     "hourlyMsgCapHint": "Global uses the minimum across domains",
     "enableAntispam": "Enable antispam mark (Rspamd multimap)",
-    "enableAntispamDesc": "Off marks domain antispam off",
+    "enableAntispamDesc": "Off keeps this domain out of the Rspamd antispam map. Write panel first, then apply to system.",
     "writeControlOnly": "Write panel only",
     "applyToSystemBtn": "Apply to system",
     "dnsblResult": "DNSBL result",
@@ -3079,6 +3667,7 @@
     "health": {
       "dnsUnconfirmed": "DNS records (MX/SPF/DKIM) not yet confirmed",
       "dmarcMissing": "DMARC missing — strongly recommended",
+      "dmarcUnpublished": "DMARC is generated in the panel but not published in public DNS yet",
       "ptrBad": "PTR reverse DNS missing or incorrect — request at VPS provider",
       "port25Blocked": "Outbound Port 25 appears blocked — request unblock or use SMTP relay",
       "port25Unknown": "Port 25 status unknown — run connectivity check"
@@ -3122,7 +3711,8 @@
       "postfixReloaded": "Postfix reloaded.",
       "postfixReloadFailed": "Postfix reload failed: {{detail}}",
       "dovecotApplied": "Wrote Dovecot TLS snippet and attempted reload.",
-      "dovecotSkipped": "Skipped Dovecot (not installed or doveconf unavailable)."
+      "dovecotSkipped": "Skipped Dovecot (not installed or doveconf unavailable).",
+      "dovecotSslOmitted": "Mail certificate is missing; wrote ssl=no so Dovecot can start without the LE files."
     },
     "policyApplySystemHint": "Check “apply to system” to write Postfix/Rspamd maps and reload;",
     "rateLimitAppliedNote": "Hourly outbound rate and antispam flag applied (when system apply is on).",
@@ -3161,12 +3751,12 @@
     "deliverabilityDesc": "PTR / DNS / port 25 checks",
     "dnsTodosDesc": "Copy then add at your DNS host",
     "deliverabilityHonesty": "Cannot set PTR or unlock port 25 for you",
-    "warmupSuggest": "暖身建議",
-    "writeSsoSkeleton": "寫入 Roundcube SSO 骨架",
-    "rateLimitPerHour": "每小時訊息上限",
-    "rateLimitGlobalHint": "全域取各域名最小值",
-    "savePolicyWritten": "只寫入控制面",
-    "dnsblMultiIp": "多 IP RBL",
+    "warmupSuggest": "Warm-up suggestions",
+    "writeSsoSkeleton": "Write Roundcube SSO skeleton",
+    "rateLimitPerHour": "Hourly message cap",
+    "rateLimitGlobalHint": "Global cap uses the lowest per-domain limit",
+    "savePolicyWritten": "Written to the control plane only",
+    "dnsblMultiIp": "Multi-IP RBL",
     "webmailTool": "Webmail software",
     "webmailToolRoundcube": "Roundcube (default)",
     "webmailToolSnappy": "SnappyMail (lightweight)",
@@ -3176,6 +3766,9 @@
     "webmailRisk": "Public webmail is risky — enable HTTPS soon.",
     "webmailForceHttps": "Force HTTPS (Roundcube; SSL required)",
     "reinstallWebmail": "Reinstall / upgrade",
+    "installWebmailTitle": "Create the shared webmail project (first install)",
+    "reinstallWebmailTitle": "Rebuild / upgrade the existing webmail project",
+    "reinstallNeedInstall": "Install webmail first",
     "webmailSsoAdvanced": "Advanced · SSO plugin",
     "tlsRoleMail": "mail (IMAP/SMTP)",
     "tlsRoleMailHint": "Mail server hostname",
@@ -3184,6 +3777,7 @@
     "tlsRoleApex": "Apex domain",
     "tlsRoleApexHint": "Web / apex certificate",
     "tlsRequestLe": "Request LE",
+    "tlsRequestLeFor": "Request LE for {{host}}",
     "advancedToolsTitle": "Queue & clients",
     "flushQueueConfirm": "Flush the local MTA queue? This cannot be undone.",
     "mailSslTitleShort": "Certificates & TLS",
@@ -3238,7 +3832,25 @@
     "mailboxEmptyTitle": "No mailboxes yet",
     "passwordMismatch": "Passwords do not match",
     "passwordTooShort": "Password must be at least 8 characters",
-    "mailboxUpdateNeedField": "Set a new password or change status"
+    "mailboxUpdateNeedField": "Set a new password or change status",
+    "catchallHint": "Unknown local parts go to the target mailbox. Draft until mail apply.",
+    "queueSearchPh": "Search ID, sender, or recipient…",
+    "queueId": "Queue ID",
+    "queueSender": "Sender",
+    "queueRecipients": "Recipients",
+    "queueSize": "Size",
+    "queueReason": "Reason",
+    "queueActive": "Active",
+    "queueHeld": "Held",
+    "queueDeferred": "Deferred",
+    "deleteQueueTitle": "Delete this queued message?",
+    "deleteQueueDesc": "Remove {{id}} from the local MTA queue. Needs YSK_EXECUTE.",
+    "openQueuePage": "Open mail queue",
+    "dovecotFailedHint": "Dovecot failed. Open the Software tab for the unit status.",
+    "dovecotFailedStatus": "Dovecot is {{status}}. Open the Software tab for the unit summary.",
+    "mailCertMissing": "No certificate for {{hosts}}. Issue it on the SSL page.",
+    "mailCertPresent": "A mail certificate is already issued — this is not a missing-cert problem.",
+    "webmailNeedCert": "No certificate for {{host}} — issue it on SSL before forcing HTTPS."
   },
   "errors": {
     "YSK_UNAUTHORIZED": "Unauthorized",
@@ -3267,7 +3879,7 @@
       "adminTotpStrict": "Admins must enable 2FA (strict). Use an enrolled account or disable strict mode.",
       "totpReplay": "Code already used; wait for the next period",
       "totpRequired": "A valid authentication code is required",
-      "mustEnrollTotp": "Admin policy: enable two-factor authentication now",
+      "mustEnrollTotp": "Policy: enable two-factor authentication now",
       "userNotFound": "User not found",
       "totpSetupNeedReauth": "Enabling 2FA requires your password (or a recent step-up code)",
       "totpBeginFirst": "Start 2FA setup first",
@@ -3279,7 +3891,9 @@
       "sessionExpired": "Session expired; sign in again",
       "sessionIdle": "Idle timeout; sign in again",
       "totpNotEnabled": "2FA is not enabled",
-      "totpSecretNoDataDir": "TOTP secret is encrypted but dataDir is not set"
+      "totpSecretNoDataDir": "TOTP secret is encrypted but dataDir is not set",
+      "mustChangePassword": "You must set a new password before continuing",
+      "policyNeedsOwn2fa": "Turn on 2FA for this account and confirm with a TOTP code before requiring 2FA for others"
     },
     "http": {
       "notFoundRoute": "Not found: {{method}} {{path}}",
@@ -3289,7 +3903,8 @@
       "unprocessable": "Request rejected by server",
       "requestFailed": "Request failed ({{status}})",
       "jsonInvalid": "Invalid JSON",
-      "internal": "Internal error"
+      "internal": "Internal error",
+      "payloadTooLarge": "Request body is too large"
     },
     "YSK_HOST_BROWSE_SSRF": "Host browse blocked by security policy",
     "YSK_HOST_BROWSE_SESSION": "Host browse session not found or expired",
@@ -3306,10 +3921,10 @@
     "startService": "Start service",
     "notInstalled": "fail2ban is not installed",
     "toolHintPrefix": "Underlying tools:",
-    "toolHintBody": "fail2ban = after scanning logs,",
-    "toolHintTemp": "temporary",
-    "toolHintBody2": "bans · for attack response use",
-    "toolHintUfw": "UFW = ports / permanent rules",
+    "toolHintBody": "fail2ban temporarily bans after scanning logs. For attack response use",
+    "toolHintTemp": "",
+    "toolHintBody2": "",
+    "toolHintUfw": "handles ports and permanent rules.",
     "tabs": {
       "bans": "Ban list",
       "whitelist": "Whitelist",
@@ -3334,11 +3949,15 @@
     "emptyBansDesc": "Or no permission to read fail2ban-client",
     "ignoreipTitle": "ignoreip whitelist",
     "ignoreipDesc": "IPs never banned (panel file + optional live fail2ban-client)",
+    "whitelistEmptyWarn": "Whitelist is empty while jails can ban you. Add your login IP before applying ignoreip.",
+    "suggestIgnoreLogin": "Your login IP {{ip}}",
+    "applyIgnoreEmptyWarn": "Applying with an empty whitelist clears ignoreip",
+    "applyIgnoreNeedConfirm": "Rewrites jail ignoreip and reloads fail2ban",
     "addIp": "Add IP",
     "addWhitelist": "Add to whitelist",
     "applyPolicyIgnoreip": "Apply policy (incl. ignoreip)",
     "applyIgnoreipOk": "Wrote ignoreip into jail.local and applied",
-    "ignoreipHint": "Without YSK_EXECUTE only panel file is written (apply_status=written);",
+    "ignoreipHint": "Without system-change permission only the panel file is written. Apply policy rebuilds jail.local ignoreip and reloads.",
     "whitelistTitle": "Whitelist ({{count}})",
     "whitelistRemoved": "Removed from whitelist",
     "remove": "Remove",
@@ -3376,13 +3995,36 @@
       "reload": "fail2ban reloaded",
       "restart": "fail2ban restarted",
       "stop": "fail2ban stopped"
-    }
+    },
+    "statWhitelist": "Whitelist",
+    "invalidIp": "Enter a valid IPv4, IPv6, or CIDR.",
+    "whitelistPendingApply": "Saved to the panel list. Press Apply policy to write jail.local.",
+    "ignoreipFile": "dataDir/fail2ban/ignoreip.txt",
+    "jailsTabHint": "Status of active jails. Turn jails on or off in the Policy tab.",
+    "colJail": "Jail",
+    "colEnabled": "On",
+    "serviceStateLine": "Unit {{unit}} · {{state}} · boot {{boot}}",
+    "jail": {
+      "sshd": "SSH brute-force",
+      "nginxHttpAuth": "Nginx HTTP authentication",
+      "nginxBotsearch": "Nginx scanner / bot probes",
+      "nginxBadbots": "Nginx known bad bots",
+      "nginxLimitReq": "Nginx rate-limit jail",
+      "postfix": "Postfix mail brute-force",
+      "dovecot": "Dovecot mail login",
+      "recidive": "Repeat offenders"
+    },
+    "cannotBanSelf": "This is the host or your login IP — add it to ignoreip instead of banning",
+    "suggestIgnoreHint": "Suggested admin IPs (panel file only until you apply policy):",
+    "suggestIgnoreAdd": "Add {{ip}}"
   },
   "featurePage": {
     "back": "Back"
   },
   "files": {
     "pillFiles": "{{count}} files",
+    "pillTrash": "{{count}} in trash",
+    "pillSpace": "{{used}} used",
     "statFiles": "Files",
     "statFolders": "Folders",
     "statUsage": "Usage",
@@ -3441,10 +4083,14 @@
     "selectAllAria": "Select all",
     "selectAll": "Select all",
     "folder": "Folder",
+    "dirNamedLikeFile": "(folder leftover; name looks like a file)",
     "dropToUpload": "Drop to upload",
     "trashTitle": "Trash ({{count}})",
     "trashDesc": "Deleted files can be restored or permanently removed",
     "emptyTrash": "Empty trash",
+    "emptyTrashTitle": "Empty trash?",
+    "emptyTrashDesc": "Every file in trash will be permanently deleted. This cannot be undone.",
+    "purgeForeverDesc": "This file will be permanently deleted. This cannot be undone.",
     "emptyTrashDone": "Trash emptied",
     "colOrigPath": "Original path",
     "colDeletedAt": "Deleted at",
@@ -3472,12 +4118,15 @@
     "enabledMount": "Enabled · {{path}}",
     "notEnabled": "Not enabled",
     "disable": "Disable",
+    "webdavAlreadyOff": "WebDAV is already off",
     "webdavDisabled": "WebDAV disabled",
     "webdavEnabledNoEcho": "Enabled (password will not be shown again; re-issue if needed)",
     "webdavDefaultOff": "Off by default — click Enable and issue token to start",
+    "webdavAfterEnable": "Available after you enable WebDAV and issue a token.",
     "webdavOn": "Enabled",
     "webdavOff": "Disabled",
     "webdavTokenId": "Token #{{id}}",
+    "webdavTokenInactive": "Disabled — token #{{id}} is not active",
     "webdavUpdated": "Updated {{at}}",
     "webdavTokenOnceTitle": "Copy the password now",
     "webdavTokenOnceHint": "This password is shown only once; it cannot be retrieved after you leave this page.",
@@ -3569,6 +4218,9 @@
     "movedToTrash": "Moved to trash",
     "moveToTrashTitle": "Move to trash?",
     "moveToTrashDesc": "Delete {{count}} item(s) (restorable from trash)",
+    "deleteMore": " and {{n}} more",
+    "unshareTitle": "Revoke this share?",
+    "unshareDesc": "Revoke the link for {{name}} ({{url}}). The link stops working immediately.",
     "preview": "Preview",
     "imagePreviewNeedLogin": "Image preview needs login; use download instead",
     "pdfDownloadHint": "Download PDF to open (needs auth headers)",
@@ -3699,7 +4351,37 @@
     "publicShareBtFailed": "WebTorrent failed: {{detail}}",
     "publicShareBtNeedMagnet": "No magnet URI for this share",
     "publicShareBtUnsupported": "This browser cannot run WebTorrent; use magnet or .torrent instead",
-    "btNone": "—"
+    "btNone": "—",
+    "uploadStatusSkipped": "Skipped",
+    "uploadStatusCancelled": "Cancelled",
+    "conflict": {
+      "titleFile": "An item named “{{name}}” already exists",
+      "titleFolder": "A folder named “{{name}}” already exists",
+      "descFile": "Choose what to do. Nothing is overwritten until you pick Replace.",
+      "descFolder": "Choose what to do. Merge keeps the existing folder and continues with its contents.",
+      "incoming": "Incoming",
+      "existing": "Already here",
+      "kindFile": "File",
+      "kindFolder": "Folder",
+      "skip": "Skip",
+      "skipHint": "Do not add this item",
+      "keepBoth": "Keep both",
+      "keepBothHint": "Save incoming as {{name}}",
+      "replace": "Replace",
+      "replaceHint": "Overwrite the existing file. A version snapshot is kept when possible.",
+      "replaceFolderHint": "Overwrite files with the same names inside this folder. Other files stay.",
+      "merge": "Merge",
+      "mergeHint": "Keep the existing folder and add incoming files into it",
+      "applyAll": "Apply to all remaining conflicts",
+      "applyAllHint": "Use this action for the rest of this drop or transfer",
+      "cancelRest": "Cancel remaining",
+      "progress": "{{current}} of {{total}}",
+      "typeMismatch": "A {{destKind}} named “{{name}}” is already here. Incoming is a {{incomingKind}}.",
+      "skipped": "Skipped",
+      "cancelled": "Cancelled"
+    },
+    "webdavReissueUnchanged": "Token id did not change after re-issue — the write may not have persisted. Try again.",
+    "webdavDisableFailed": "WebDAV is still enabled after disable — the write may not have persisted. Try again."
   },
   "firewall": {
     "profiles": {
@@ -3723,6 +4405,8 @@
     "statAllow": "Allow",
     "statDeny": "Deny",
     "statDefaultIn": "Default incoming",
+    "defaultNotApplied": "n/a (UFW off)",
+    "ufwOffHint": "Default incoming is not applied while UFW is off",
     "executeOn": "On",
     "executeOff": "Off",
     "ufwDisabled": "UFW disabled",
@@ -3732,6 +4416,7 @@
     "notInstalled": "UFW is not installed",
     "toolHintPrefix": "Underlying tools:",
     "toolHintBody": "UFW = ports / permanent rules · for attack response and auto-ban use",
+    "toolHintfail2ban": "fail2ban = temporary log-based bans",
     "toolHintFail2ban": "fail2ban = temporary log-based bans",
     "executeOffHint": "System changes off — status is readable;",
     "tabs": {
@@ -3792,6 +4477,7 @@
     "deleteRuleDesc": "Removes that UFW rule number (needs system-change permission).",
     "servicesTitle": "Managed services",
     "servicesHint": "Desired network exposure for YSK services. Opening a service syncs these rules automatically.",
+    "servicesUfwOff": "UFW is off. This list is the desired exposure, not rules the host is enforcing.",
     "servicesEmpty": "No service exposure data yet",
     "servicesEmptyDesc": "Start a managed service (web, FTPS, VPN, DB…) to populate this list.",
     "servicesManualHint": "Manual port chips are under the Ports tab — prefer managing access here so rules stay tagged (ysk-svc).",
@@ -3801,7 +4487,12 @@
     "colPorts": "Ports",
     "colSync": "Status",
     "synced": "Synced",
-    "syncNow": "Sync"
+    "syncNow": "Sync",
+    "disableConfirmTitle": "Disable UFW?",
+    "disableConfirmDesc": "The host firewall will stop filtering traffic. SSH and the panel can be exposed if the host is on a public network.",
+    "disableConfirmConsequence": "Existing allow/deny rules stay stored but are not enforced until UFW is enabled again.",
+    "desiredOnlyUfwOff": "Desired: {{mode}} · UFW off (not applied)",
+    "syncNotApplied": "UFW off · not applied"
   },
   "ftp": {
     "title": "FTPS accounts",
@@ -3866,7 +4557,13 @@
     "listenPortHint": "Default 21; open firewall if using another port",
     "customPort": "Custom port",
     "ipStack": "IP stack",
-    "ipStackHint": "Most vsftpd builds: listen and listen_ipv6 are mutually exclusive;",
+    "ipStackHint": "Most vsftpd builds: listen and listen_ipv6 are mutually exclusive.",
+    "listenConflictLive": "Live vsftpd.conf has listen={{v4}} and listen_ipv6={{v6}} — both YES will fail to start.",
+    "listenConflictNeedFix": "Fix listen / listen_ipv6 first (they cannot both be YES), then apply.",
+    "fixListenIpv4": "Use IPv4 only (listen=YES, listen_ipv6=NO)",
+    "liveFileValue": "File now: {{value}}",
+    "startBlockedFailed": "Service is failed — apply a valid config before start",
+    "ftpsNeedCert": "Pick a certificate domain first",
     "ipv4Only": "IPv4 only",
     "ipv6Mapped": "IPv6 (mapped OK)",
     "bannerHint": "Welcome string clients see after connect",
@@ -3878,7 +4575,10 @@
     "openFirewallPage": "Open firewall page",
     "customEnd": "Custom end",
     "pasvPublicIp": "PASV public IP",
+    "detectPublicIp": "Detect public IP",
+    "detectPublicIpTitle": "Fill the first non-loopback IPv4 from this host",
     "pasvPublicIpHint": "NAT/cloud: set public IP; local can leave empty",
+    "pasvIpRequired": "Set a public PASV IP before apply (NAT/cloud). Detect or type an address.",
     "optionalEmpty": "(optional)",
     "securityTitle": "Security settings",
     "securityDesc": "TLS, write access, chroot; Apply and restart to take effect",
@@ -3900,7 +4600,7 @@
     "opsResult": "Ops result",
     "saved": "Saved",
     "accountsList": "Account list",
-    "accountsListDesc": "After create, Apply to sync vsftpd. If service missing, install above then ",
+    "accountsListDesc": "After create, Apply to sync vsftpd. If it is not installed, use the Software tab.",
     "startService": " start.",
     "createAccountPlus": "+ Create account",
     "noFtpAccounts": "No FTP accounts yet",
@@ -3936,7 +4636,13 @@
     "sftpRegister": "Register key",
     "sftpAddedAt": "Added {{time}}",
     "sftpTechSummary": "Technical details (advanced)",
-    "sftpTechNote": "Keys are written under the managed path"
+    "sftpTechNote": "Keys are written under the managed path",
+    "filterProject": "Showing FTP accounts for this project",
+    "clearProjectFilter": "Show all accounts",
+    "vsftpdFailedHint": "vsftpd failed. Open the Service tab (listen and listen_ipv6 cannot both be YES).",
+    "vsftpdFailedGeneric": "vsftpd failed. Open the Service tab for live settings and journal.",
+    "stateFailed": "Failed to start",
+    "tabService": "Service"
   },
   "geo": {
     "continents": {
@@ -4109,6 +4815,7 @@
     "viaHost": "via host",
     "emptyTitle": "Host-mediated browse",
     "emptyBody": "Enter a URL. DNS, TLS, and egress use this server — not your browser. Cookies stay in a server-side jar.",
+    "needUrl": "Enter a URL above to start a session.",
     "ssrfBlocked": "Blocked by security policy (SSRF / mode)",
     "loadFailed": "Fetch failed on host",
     "sessionReady": "Session ready",
@@ -4127,12 +4834,15 @@
     "engineBrowser": "Real browser",
     "engineSwitchHint": "Switching engine opens a new session.",
     "needChrome": "Real browser needs system Chrome/Chromium (or set YSK_HOST_BROWSE_CHROME). Using proxy otherwise.",
+    "engineBrowserNeedChrome": "Real browser (Chrome not installed)",
+    "egressHint": "The target site sees this server’s outbound address ({{host}}), not your laptop. Cookies stay in the server session jar.",
     "needChromeFallback": "Chrome unavailable — switched to proxy engine.",
     "liveError": "Live stream failed",
     "liveWaiting": "Connecting host browser…",
     "tabSettings": "Settings",
     "softwareNeeded": "Chromium / Chrome required for real browser engine",
-    "softwareHint": "One-click installs distro Chromium via apt. Google Chrome binary is also detected if already present. Requires root + YSK_EXECUTE=1.",
+    "softwareHint": "One-click installs distro Chromium via apt. Google Chrome is also detected if already present. Needs superuser and system-change permission.",
+    "closeNoSession": "No session yet",
     "goInstallChrome": "Open Software tab",
     "settingsIntro": "These panel settings override process environment variables for Host Browse.",
     "settingsEngine": "Default engine",
@@ -4173,6 +4883,8 @@
     },
     "home": "Home",
     "bookmark": "Bookmark",
+    "bookmarkAdd": "Add or remove bookmark",
+    "bookmarkList": "Bookmark list",
     "bookmarks": "Bookmarks",
     "history": "History",
     "bookmarkToggled": "Bookmark updated",
@@ -4181,6 +4893,7 @@
     "mediaNote": "Real browser: video is streamed into the panel. Enable audio bridge in Settings to hear page audio (requires user gesture).",
     "isolationNote": "Real browser creates an ephemeral Linux user for Chrome; leaving the page or idle timeout destroys that user.",
     "resumeHint": "Resume previous session ({{count}} tabs)",
+    "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}",
     "resume": "Resume",
     "resumeDismiss": "Dismiss",
     "resumeDone": "Session resumed",
@@ -4215,7 +4928,20 @@
     "mediaAudioLabel": "Audio",
     "mediaAudioDesc": "Optional bridge from host Chrome; may require unlock click.",
     "mediaPolicyLabel": "Policy",
-    "mediaPolicyDesc": "Downloads and autoplay follow the safety and download settings above."
+    "mediaPolicyDesc": "Downloads and autoplay follow the safety and download settings above.",
+    "frameBlocked": "The page could not be shown in the panel frame.",
+    "historyEmpty": "No history in this session.",
+    "bookmarksEmpty": "No bookmarks yet.",
+    "closeSessionHint": "Clears cookies for this browse session. Bookmarks stay.",
+    "envUnset": "not set",
+    "envPanelValue": "panel: {{value}}",
+    "envColVar": "Variable",
+    "envColHost": "Host process",
+    "envColPanel": "Panel setting",
+    "envColEffective": "Effective",
+    "settingsNoSandboxWarn": "Disables Chromium sandbox. Use only inside a trusted container. Applies on next real-browser session.",
+    "settingsDangerDlWarn": "Allows executable and script downloads through the host browser. Confirm you need this.",
+    "settingsDangerConfirmTitle": "Enable a high-risk browse setting?"
   },
   "listToolbar": {
     "searchPlaceholder": "Search…",
@@ -4227,7 +4953,8 @@
     "activeFilters": "{{count}} filters active",
     "noResults": "No matches",
     "noResultsHint": "Try another keyword or clear filters.",
-    "searching": "Searching…"
+    "searching": "Searching…",
+    "emptyChip": "No items in this filter"
   },
   "logViewer": {
     "banIpTitle": "Ban {{ip}} in Protection"
@@ -4244,7 +4971,12 @@
     "totpLabel": "Authentication code",
     "totpHint": "6-digit code from your authenticator app",
     "submitting": "Signing in…",
-    "sessionExpired": "Session expired; sign in again"
+    "sessionExpired": "Session expired; sign in again",
+    "newPassword": "New password",
+    "newPasswordAgain": "Confirm new password",
+    "changePassword": "Change password",
+    "passwordMismatch": "The two passwords do not match",
+    "passwordChanged": "Password updated"
   },
   "logs": {
     "catSystem": "System files",
@@ -4293,6 +5025,9 @@
     "followingSse": " · following (SSE)",
     "loadingSources": "Loading sources…",
     "pickSource": "Pick a source on the left, or a shortcut · then Query",
+    "noRowsInWindow": "No records in this time window",
+    "showInactiveUnits": "Show inactive units",
+    "sseNeedFollow": "Turn on Follow first — SSE is only for live tail",
     "maintOverview": "Maintenance overview",
     "executable": "Executable",
     "restricted": "Restricted",
@@ -4356,8 +5091,11 @@
     "lines": "{{n}} lines",
     "followingSseDyn": " · following{{sse}}",
     "ipBan": "IP → ban",
-    "vacuumNote": "Free systemd-journal disk. No EXECUTE → blocked, no fake success.",
-    "vacuumTime": "Vacuum time",
+    "vacuumNote": "Reclaims systemd-journald disk. Without execute permission the action is blocked — it is not treated as success.",
+    "vacuumTime": "Clean by retention",
+    "vacuumNeedRetention": "Enter a retention window first (for example 14d)",
+    "vacuumNeedConfirm": "Needs confirmation — deletes old journal logs",
+    "vacuumSizeNeedConfirm": "Needs confirmation — caps journal disk use",
     "vacuumHint": "Keep ≥7 days recommended; re-probe disk after.",
     "logrotateStatus": "System logrotate status (read-only probe)",
     "logrotateMissing": "No status file or unreadable — check logrotate package in services matrix",
@@ -4365,12 +5103,13 @@
     "relatedOpsDesc": "Log observation vs incident response",
     "scLogsLine": "Observe journal / files / projects",
     "scProtLine": "Incident response, auto ban (click IP)",
-    "journalVacuumTitle": "Journal vacuum",
+    "journalVacuumTitle": "Clean journald disk",
     "journalSection": "Journal",
     "sseLabel": "SSE",
     "logrotateLabel": "logrotate",
     "srcNginx": "nginx",
     "srcSsh": "ssh",
+    "srcfail2ban": "fail2ban",
     "srcFail2ban": "fail2ban",
     "srcAuthLog": "auth.log",
     "srcNginxError": "nginx error",
@@ -4379,7 +5118,29 @@
     "groupVarLog": "/var/log",
     "prioErr": "err+",
     "prioWarn": "warn+",
-    "prioInfo": "info+"
+    "prioInfo": "info+",
+    "vacuumSize": "Limit to 500 MB",
+    "logrotateNoStatus": "No logrotate status file yet (normal if it has never run).",
+    "autoVacuumOff": "Automatic clean is off. Time is unused until you enable it.",
+    "aboutAllowlist": "Explore can only read allowlisted journal units and /var/log paths. Arbitrary host paths are not offered.",
+    "aboutCustomPath": "Add a custom path on Settings (only /var/log or /run/log). Then open it from Explore.",
+    "vacuumSizeAlreadyBelow": "Current usage already below cap, this will no-op",
+    "vacuumSizeNoopDesc": "Journal is already under 500 MB. This still runs vacuum --size=500M and typically deletes nothing.",
+    "journalDiskHint": "Current systemd-journald usage (active journal). Rotated files under /var/log are not included.",
+    "varLogDiskHint": "Estimated du of /var/log, including rotated files. Approximate.",
+    "queryFirst": "Query first",
+    "errorsWindowHint": "Recent errors from the last overview probe (not live-updating when you switch tabs)",
+    "sourceCount": "{{shown}} shown",
+    "sourceUnavailable": "This source has not produced a log yet",
+    "sourceNoLog": "No log yet",
+    "projectSourcesTitle": "{{n}} source(s) (files + journal)",
+    "logrotatePath": "Path",
+    "logrotateLast": "Last rotated",
+    "exportJsonl": "JSONL export",
+    "sseLive": " (live stream)",
+    "logrotateExpand": "Show {{n}} more",
+    "logrotateCollapse": "Show fewer",
+    "logrotateVersion": "Status version {{v}}"
   },
   "metrics": {
     "alert": {
@@ -4410,6 +5171,15 @@
       "alerts": "Alerts"
     },
     "load": "Load",
+    "load1m": "Load 1m",
+    "uptime": "Uptime",
+    "filterCpu5": "≥5% CPU",
+    "filterMem5": "≥5% memory",
+    "signalHint": "Select a process, then send TERM or KILL.",
+    "signalFromRow": "Select this process for TERM / KILL",
+    "selectForSignal": "Select",
+    "forceKillTitleNamed": "KILL PID {{pid}} ({{cmd}})?",
+    "sendSigTitleNamed": "Send TERM to PID {{pid}} ({{cmd}})?",
     "min1": "1m",
     "min5": "5m",
     "min15": "15m",
@@ -4465,6 +5235,8 @@
     "noProjectsDesc": "Create a project to see real home usage here",
     "usageNote": "Usage from local du (not estimated). Quota is a control-plane soft limit; hard setquota needs apply-to-host.",
     "thresholdAlerts": "Threshold alerts",
+    "alertsBuiltinOnly": "Built-in CPU / memory / disk thresholds only. No email, webhook, or Slack channel.",
+    "lastEvaluated": "Last checked",
     "alertsOkTitle": "All clear",
     "alertsOkDesc": "No memory / load / disk threshold alerts.",
     "cpu": "CPU",
@@ -4481,6 +5253,18 @@
     "selectAllAria": "Select all filtered",
     "selectPidAria": "Select PID {{pid}}",
     "controlPlane": "Control plane",
+    "controlPlaneNoSignal": "The control-plane process cannot be signalled",
+    "protectedPid": "PID 1 / init / systemd cannot be signalled from the panel",
+    "sigTermTitle": "Send SIGTERM (ask process to exit)",
+    "sigKillTitle": "Send SIGKILL (force kill — cannot be caught)",
+    "batchTerm": "TERM",
+    "batchKill": "KILL",
+    "rawTopLabel": "Raw top (untranslated)",
+    "followSseLabel": "Follow (live stream)",
+    "alertsReadOnly": "Built-in CPU / memory / disk thresholds only. No email, webhook, or Slack channel.",
+    "alertsGoNotifications": "Open notification centre",
+    "lastCheck": "Last check",
+    "rawTopHint": "Untranslated top(1) output",
     "detailShort": "Info",
     "procUnavailable": "Could not get processes",
     "noProcData": "No process data yet",
@@ -4499,7 +5283,7 @@
     "reniceHint": "-20 highest · 19 lowest (needs EXECUTE)",
     "noData": "No data",
     "mountsTitle": "Disk mounts ({{count}})",
-    "mountsDesc": "Real df -P -B1 (tmpfs filtered)",
+    "mountsDesc": "Real disk usage (temporary filesystems filtered)",
     "noMounts": "No mount list",
     "noMountsDesc": "df unavailable or filtered. Root disk still on Overview.",
     "seeProjectUsage": "Project home usage is on the Project usage tab (real du · {{size}})",
@@ -4511,7 +5295,19 @@
     "usageNoteFull": "Usage from local du (not estimated). Quota is a control-plane soft limit; hard setquota needs apply-to-host.",
     "sseNeedLogin": "Not logged in; cannot open SSE",
     "sseSessionExpired": "Not logged in or session expired; cannot open SSE",
-    "sseHttpError": "stream HTTP {{status}}"
+    "sseHttpError": "stream HTTP {{status}}",
+    "colFilesystem": "Filesystem",
+    "colMount": "Mount",
+    "colSize": "Size",
+    "colUsed": "Used",
+    "colAvail": "Available",
+    "colUsePct": "Used %",
+    "colHome": "Home",
+    "usageNoteLink": "Control-plane soft quota. Apply hard limits on the project Isolation tab.",
+    "shareNoQuotaHint": "No quota set, so share is not a percentage. Set a quota on the project Isolation tab.",
+    "setQuotaLink": "Set quota",
+    "unusualHome": "Unusual path",
+    "unusualHomeHint": "Not a /home/… project home. Canonical isolation is /home/ysk-server-{id}."
   },
   "migrate": {
     "tabInventory": "Inventory",
@@ -4525,6 +5321,7 @@
     "subtitle": "Source control plane → full copy to new host. Afterward only change public IP/DNS; accounts, paths, and projects stay the same.",
     "inventorying": "Inventorying",
     "inventoried": "Inventoried",
+    "inventoriedWarn": "Inventoried · {{n}} warnings",
     "inventoryFailed": "Inventory failed",
     "pendingInventory": "Pending inventory",
     "projects": "Projects",
@@ -4553,6 +5350,8 @@
     "authMethod": "Auth method",
     "rootPassword": "Root password",
     "notPersisted": "Not persisted",
+    "passwordNotStored": "Password is used for this SSH session only and is not saved on disk.",
+    "overwriteDanger": "Overwrite will replace existing YSK data on the target. This cannot be undone from the panel.",
     "outboundIdentity": "Outbound identity in vault",
     "dryRun": "Dry-run precheck",
     "startMigrate": "Start full-host migration",
@@ -4581,6 +5380,16 @@
     "restartApiHint": "If you just deployed a new version, restart the API (",
     "afterRestart": ") then Refresh.",
     "inventoryWarnings": "Inventory warnings ({{count}})",
+    "orphanHomesHint": "Leftover project homes (not in the store). Remove only after you confirm they are unused.",
+    "orphanRemove": "Remove leftover home",
+    "orphanRemoveTitle": "Delete leftover project home?",
+    "orphanRemoveDesc": "Permanently delete {{path}} from disk. This is not a store project. Needs superuser and system-change permission.",
+    "orphanRemovePhrase": "Type DELETE to confirm.",
+    "orphanRemoveNeedConfirm": "Needs confirmation",
+    "orphanBackupFirst": "Back up first (open Backups)",
+    "orphanMtime": "Last modified {{at}}",
+    "expandAllWarnings": "Show all {{n}} warnings",
+    "collapseWarnings": "Show fewer",
     "moreWarnings": "…and {{n}} more",
     "authPassword": "root password (switch to key after temp key install)",
     "authIdentity": "SSH identity vault identityId",
@@ -4591,7 +5400,7 @@
     "allowOverwriteDesc": "· Required if target already has ysk.json",
     "dryRunOnly": "Dry-run only",
     "dryRunOnlyDesc": "· Inventory + precheck only; no rsync or target writes",
-    "executeNote": "Host needs YSK_EXECUTE=1 and root API. After migrate, update DNS A/AAAA and check cloud firewall + mail PTR.",
+    "executeNote": "Host needs system-change permission and a superuser API. After migrate, update DNS A/AAAA and check cloud firewall + mail PTR.",
     "dnsCutover": "DNS cutover (manual)",
     "dnsCutoverDesc": "Point A/AAAA for these names to the new public IP;"
   },
@@ -4670,7 +5479,9 @@
       "runtimes": "Runtimes",
       "security": "Security",
       "system": "System",
-      "ai": "AI"
+      "ai": "AI",
+      "validators": "Validators",
+      "containers": "Containers"
     },
     "java": "Java",
     "kotlin": "Kotlin",
@@ -4690,13 +5501,25 @@
     "bookmarkAdded": "Pinned to sidebar",
     "bookmarkRemoved": "Removed from sidebar",
     "btTracker": "BT Tracker",
-    "support": "Support"
+    "support": "Support",
+    "noAccessTitle": "No access",
+    "noAccessDesc": "Your role does not include this page. Ask an admin if you need it.",
+    "backToDashboard": "Back to dashboard",
+    "validators": "Validators (Beta)",
+    "docker": "Docker"
   },
   "network": {
     "title": "Network interfaces",
     "canMutate": "Mutable",
     "readOnlyBlocked": "Read-only / blocked",
     "statIfaces": "Interfaces",
+    "statUp": "Up",
+    "oper": {
+      "up": "Up",
+      "down": "Down",
+      "unknown": "Unknown",
+      "other": "Other"
+    },
     "statGateway": "Gateway",
     "pageActions": "Page actions",
     "loadingSnap": "Loading network snapshot…",
@@ -4729,6 +5552,8 @@
     "defaultDev": "Default egress: {{dev}}",
     "saveNm": "Save (NetworkManager, survives reboot)",
     "ephemeralHint": "Unchecked = live ip route add only",
+    "nmUnavailable": "NetworkManager is not running — only a live route can be added",
+    "defaultRouteDownNeedName": "This is the default route egress. Type the interface name to confirm — the panel may disconnect.",
     "saveRoute": "Save route",
     "dnsSettings": "DNS settings",
     "dnsNmHint": "Writes NM connection “{{conn}}” and reconnects (persistent)",
@@ -4797,9 +5622,17 @@
     "applyDnsNotes": "Apply runs nmcli connection modify + up; brief disconnect is normal. Stub 127.0.0.53 is not written (local resolved).",
     "testResolve": "Test resolve",
     "loadRaw": "Load raw output",
+    "hideRaw": "Hide raw output",
+    "rawLoadedAt": "Loaded {{time}}",
     "confirmDown": "Confirm Down",
+    "linkDownTitle": "Take {{name}} offline",
+    "linkDownNeedConfirm": "Type the interface name to confirm",
     "defaultRouteDownWarn": "This interface is the default route egress; down may cut panel access.",
     "deleteDefaultMayDrop": " — deleting default may drop connectivity.",
+    "deleteDefaultPanelWarn": "Deleting the default route can drop this panel session. Type DEFAULT to confirm.",
+    "deleteDefaultNeedConfirm": "Needs confirmation — type DEFAULT (may drop this panel)",
+    "deleteRouteNeedConfirm": "Needs confirmation",
+    "typeDefaultToConfirm": "Type DEFAULT to confirm",
     "gateway": "Gateway",
     "nameservers": "Nameservers",
     "searchDomains": "Search domains",
@@ -4829,10 +5662,16 @@
         "azure_frontdoor": "Azure Front Door",
         "gcore": "Gcore CDN",
         "custom": "Custom proxies"
-      }
+      },
+      "needProvider": "Choose a CDN provider before fetching its IP list.",
+      "spoofWarn": "Trusting the wrong CIDR lets clients spoof X-Forwarded-For / CDN headers as their IP."
     },
     "linkUp": "Up",
-    "linkDown": "Down"
+    "linkDown": "Down",
+    "linkDownDefault": "Down default route",
+    "loopbackImmutable": "Loopback cannot be changed",
+    "operUnknownHint": "Kernel did not report UP/DOWN (common for lo). The interface is still usable.",
+    "persistNmHint": "Persistable means changes can survive reboot via NetworkManager."
   },
   "nginx": {
     "pillSites": "{{count}} site(s)",
@@ -4918,6 +5757,12 @@
     "setIndexes": "Directory listing",
     "bodyInherit": "Global"
   },
+  "notFound": {
+    "title": "Page not found",
+    "body": "No panel page at {{path}}.",
+    "hint": "Unknown URLs no longer send you to the dashboard.",
+    "home": "Dashboard"
+  },
   "notes": {
     "notFound": "Not found",
     "needPath": "Specify a path",
@@ -4950,16 +5795,42 @@
     },
     "ssh": {
       "identityNotFound": "Identity not found",
-      "registrationNotFound": "Registration not found"
+      "registrationNotFound": "Registration not found",
+      "keyOkNologin": "Key accepted. Account is nologin or SFTP-only (no SSH shell). Treated as PASS.",
+      "keyOkSftp": "SFTP pwd succeeded after SSH shell was refused."
     },
     "cdn": {
       "siteNotFound": "CDN site not found",
-      "nodeMissing": "Node does not exist"
+      "nodeMissing": "Node does not exist",
+      "loopbackOriginRemote": "Origin is 127.0.0.1 — that is this host, not a remote edge. Set a reachable origin IP or bind_ip.",
+      "originRemoteRewrite": "Remote edges will use reachable origin {{url}} instead of loopback.",
+      "originRemoteUnknown": "Origin is loopback and no public/LAN IP or bind_ip is known — apply will refuse remote edges until one is set.",
+      "needSshOrFleet": "Remote edge needs an outbound SSH identity (or username) or a /agents fleet session. Health URL alone is not apply transport.",
+      "probe": {
+        "timeout": "Connect timeout after {{ms}}ms ({{detail}}). Peer may be firewalled.",
+        "dns": "DNS lookup failed ({{detail}}).",
+        "refused": "Connection refused after {{ms}}ms ({{detail}}). Port closed or one-way block.",
+        "tls": "TLS verify failed ({{detail}}).",
+        "unreach": "Host unreachable after {{ms}}ms ({{detail}}).",
+        "http": "HTTP probe failed after {{ms}}ms ({{detail}})."
+      }
     },
     "backup": {
+      "testUnsaved": "Testing unsaved form values (not written to settings).",
+      "testIdentity": "sftp (identity) to {{spec}} ok",
+      "sshAuthFailed": "SSH key or password rejected (publickey). Pick an outbound identity or install sshpass.",
+      "remotePathIsFile": "Remote path {{path}} is a file. Use a directory.",
+      "remoteMkdirFailed": "Could not create remote directory: {{detail}}",
+      "sidecarPushed": "Also pushed SQL sidecar {{name}}",
       "fileNotFound": "Backup file not found",
       "resticNoPassword": "restic is enabled but password is not set",
-      "resticNotInPath": "restic not in PATH"
+      "resticNotInPath": "restic not in PATH",
+      "dbEnvUnreadable": "Could not read .db.env; skipped SQL dump.",
+      "dbEnvNoName": ".db.env has no database name; skipped SQL dump.",
+      "targetOutside": "Restore target must be inside the project home or the public files root.",
+      "controlPlaneDryRun": "Preview only — nothing written. In the panel, use Restore and confirm the phrase to write.",
+      "controlPlaneNeedConfirm": "Full control-plane restore needs the confirm phrase RESTORE-CONTROL-PLANE.",
+      "controlPlaneRestartAfter": "Restart the API after a successful restore."
     },
     "redis": {
       "cliMissing": "redis-cli is not installed"
@@ -5003,7 +5874,8 @@
       "pathOutsideSandbox": "Path outside sandbox: {{target}}",
       "notFoundRel": "Not found: {{relPath}}",
       "fileNotFoundRel": "File not found: {{relPath}}",
-      "notFoundFrom": "Not found: {{fromPath}}"
+      "notFoundFrom": "Not found: {{fromPath}}",
+      "alreadyExists": "Already exists: {{name}}"
     },
     "dns": {
       "needZoneServerIp": "Enter zone and server IP",
@@ -5043,7 +5915,10 @@
     },
     "db": {
       "needExecuteCreate": "Host execute is off; cannot create database from the panel",
-      "dryRunMysql": "dry-run: database not created. Use --execute with YSK_EXECUTE=1 to provision"
+      "dryRunMysql": "dry-run: database not created. Use --execute with YSK_EXECUTE=1 to provision",
+      "remoteNoCreds": "No username/password stored — TCP only (registration is not a login).",
+      "remoteReachable": "TCP {{host}}:{{port}} open ({{ms}}ms).",
+      "remoteUnreachable": "TCP {{host}}:{{port}} closed or filtered ({{ms}}ms)."
     },
     "net": {
       "invalidIface": "Invalid interface name",
@@ -5124,7 +5999,17 @@
       "dns": "DNS",
       "email": "Email",
       "isolation": "Project isolation",
-      "ops": "Operations"
+      "ops": "Operations",
+      "runtimesNode": "Node.js",
+      "runtimesPhp": "PHP",
+      "runtimesPython": "Python",
+      "runtimesGo": "Go",
+      "pm2": "PM2",
+      "runtimesNodeFix": "Install Node from /runtimes/node",
+      "runtimesPhpFix": "Install PHP from /runtimes/php",
+      "runtimesPythonFix": "Install Python from /runtimes/python",
+      "runtimesGoFix": "Install Go from /runtimes/go",
+      "pm2Fix": "Install PM2 from the Node runtime page"
     },
     "needAdmin": "Administrator permission required",
     "notInstalled": "Not installed",
@@ -5135,6 +6020,44 @@
     "probe": "Probe",
     "install": "Install",
     "port": "Port",
+    "git": {
+      "missingBin": "git is not on PATH",
+      "auth": "Authentication failed. Add a deploy key or HTTPS token.",
+      "hostkey": "SSH host key verification failed. Confirm and pin the host key.",
+      "dirty": "Working tree has {{count}} local change(s). Pull is blocked.",
+      "diverged": "Cannot fast-forward. Reset to the remote ref if you intend to discard local Git history.",
+      "missingRef": "That branch, tag, or commit is not on the remote.",
+      "shallow": "This clone is shallow. Fetch full history before pinning an old commit.",
+      "notRepo": "app/ is not a Git repository yet.",
+      "diffEmpty": "No unstaged diff (protected .env is excluded).",
+      "unrelated": "Unrelated histories. Reclone only after confirm — custom files will be lost.",
+      "lock": "Git index.lock is present. Remove it only if no git process is running.",
+      "disk": "Disk full or quota exceeded.",
+      "timeout": "Git timed out.",
+      "network": "Network error talking to the remote.",
+      "lfs": "This repo uses Git LFS and git-lfs is not available.",
+      "submodule": "Submodule update failed.",
+      "unknown": "Git failed. See the command output.",
+      "fetchOk": "Fetched from origin.",
+      "checkoutOk": "Checked out {{ref}}.",
+      "resetOk": "Reset hard to {{ref}}.",
+      "envRestored": "Restored app/.env from the control plane.",
+      "needPinHost": "SSH host key is not pinned. Scan and pin it before clone or fetch.",
+      "tokenSaved": "HTTPS token stored (never shown again).",
+      "tokenCleared": "HTTPS token removed.",
+      "tokenInvalid": "Token must be at least 8 characters.",
+      "deployKeyCreated": "Deploy key created. Add the public key on the Git host.",
+      "deployKeyCleared": "Deploy key detached from this project.",
+      "hostPinned": "Pinned SSH host keys for {{host}}.",
+      "hostUnpinned": "Cleared pinned SSH host keys.",
+      "hostScanFailed": "ssh-keyscan returned no keys for that host.",
+      "hookEnabled": "Inbound Git hook is on. Paste the URL into GitHub, Gitea, or GitLab yourself.",
+      "hookDisabled": "Inbound Git hook is off. The URL will not sync.",
+      "hookSecretOnce": "Copy this hook secret now. It is not shown again.",
+      "refsNeedUrl": "Enter a Git URL first.",
+      "refsOk": "Loaded {{branches}} branch(es) and {{tags}} tag(s).",
+      "refsEmpty": "Remote advertised no branches or tags."
+    },
     "auto": {
       "n0001": "Status: applied",
       "n0002": "User not found",
@@ -5397,7 +6320,7 @@
       "n0259": "domain",
       "n0260": "domain Not found:",
       "n0261": "dovecot reload failed or servicenot (sieve Wrote; reload Success)",
-      "n0262": "dry-run fleet dispatch (not )",
+      "n0262": "dry-run fleet dispatch (not queued)",
       "n0263": "dry-run peer push (not scp)",
       "n0264": "dry-run remote install (not ssh)",
       "n0265": "dry-run transfer done ( full bootstrap)",
@@ -5406,10 +6329,10 @@
       "n0268": "dry-run — not write /etc",
       "n0269": "dry-run: add --execute firstapply ufw",
       "n0270": "dry-run: inventory + preflight passed, not package/transfer",
-      "n0271": "dry-run: probe/. add --execute YSK_EXECUTE=1 firstreally provision",
-      "n0272": "dry-run: Wrote managed file (dataDir). add execute + YSK_EXECUTE=1 + root firstsystem drop-in",
-      "n0273": "dry-run: not. add --execute YSK_EXECUTE=1 firstreally ban",
-      "n0274": "dry-run: not. add --execute YSK_EXECUTE=1 firstreally unban",
+      "n0271": "Dry-run: probe/plan only. Pass --execute with YSK_EXECUTE=1 to actually provision.",
+      "n0272": "Dry-run: wrote the managed file (dataDir). Pass --execute with YSK_EXECUTE=1 as root to install the system drop-in.",
+      "n0273": "Dry-run: not banned. Pass --execute with YSK_EXECUTE=1 to actually ban.",
+      "n0274": "Dry-run: not unbanned. Pass --execute with YSK_EXECUTE=1 to actually unban.",
       "n0275": "dryRun=true — change API",
       "n0276": "dryRun: not write",
       "n0277": "dump Wrote dataDir, not transfer",
@@ -5519,7 +6442,7 @@
       "n0381": "post-transfer reapply",
       "n0382": "post-transfer restore",
       "n0383": "postconf not message_rate_limit (complete applied)",
-      "n0384": "postgres-replica Supports postgres",
+      "n0384": "kind postgres-replica needs --engine postgres",
       "n0385": "postgres_databases name",
       "n0386": "postqueue unavailable or mailNot installed",
       "n0387": "Install nginx on the host, or use panel software / runtime install",
@@ -5688,7 +6611,7 @@
       "n0550": "128M, 256M, 512M, -1 ()",
       "n0551": "e.g. 512MiB; leave empty to unset",
       "n0552": "900 1 300 10; disable",
-      "n0553": ": --member 10.0.0.3=replica:fleet:SESSION_UUID",
+      "n0553": "Paste a session UUID from /agents on the cluster form, or CLI --member 10.0.0.3=replica:fleet:SESSION_UUID",
       "n0554": "= ASN (system), not",
       "n0555": "22/80/443; can offnot port",
       "n0556": "kept: 10",
@@ -5758,7 +6681,7 @@
       "n0620": "startprocessnot process",
       "n0621": "OPcache",
       "n0622": "SSL",
-      "n0623": "",
+      "n0623": "Active",
       "n0624": "file",
       "n0625": "file",
       "n0626": "node wsrep, HA ≥2 node",
@@ -5785,7 +6708,7 @@
       "n0647": "intern (MB)",
       "n0648": "password",
       "n0649": "Error, please apply",
-      "n0650": "Security → My security → enable 2FA; policy may set requireAdminTotp",
+      "n0650": "Enable admin 2FA under Security → My security, then add a backup admin on Users.",
       "n0651": "and path",
       "n0652": "install PAM",
       "n0653": "install vsftpd",
@@ -5974,7 +6897,7 @@
       "n0836": "certificateplease Failed",
       "n0837": "≥ file",
       "n0838": "settingskeptbackup",
-      "n0839": "Successthis target can BatchMode, ≠",
+      "n0839": "Success means this target accepts BatchMode SSH (non-interactive). It is not a grant of global access.",
       "n0840": "or 32767",
       "n0841": "softwareInstalled",
       "n0842": "permission/",
@@ -6134,7 +7057,7 @@
       "n0996": "local nginx -t OK ( managed conf, ≠ edge applied)",
       "n0997": "local wsrep can, size not node",
       "n0998": "local ysk.json cannotread / fingerprint",
-      "n0999": "local OK; complete healthy peer probe (not )",
+      "n0999": "Local node is OK; a complete healthy status needs a peer probe (not done).",
       "n1000": "local nginx — conf Wrote, not reload",
       "n1001": "localAvailable NM connection; willSuccess. can \"\" or NetworkManager.",
       "n1002": "localAvailable ps — cannot ()",
@@ -6260,7 +7183,7 @@
       "n1120": "domain — map for (systemapplywill postmap )",
       "n1121": "IP",
       "n1122": "Available auto-ban enrich",
-      "n1123": "cannot ban to system: YSK_EXECUTE; to panel ban",
+      "n1123": "Cannot ban on the host: YSK_EXECUTE is off. The panel list was not changed.",
       "n1124": "cannot dump Redis: redis-cli",
       "n1125": "cannot dump: serverHost execute is not enabled",
       "n1126": "cannot fan-out: Host execute is not enabled",
@@ -6310,7 +7233,7 @@
       "n1170": "cannot from npm or GitHub version (not )",
       "n1171": "cannotprobe systemctl",
       "n1172": "cannot DNS cluster: Host execute is not enabled",
-      "n1173": "cannot: Host execute is not enabled (backupSuccess)",
+      "n1173": "Host execute is off. Live SFTP/S3/local probe needs YSK_EXECUTE=1.",
       "n1174": "cannot metrics",
       "n1175": "cannot: serverHost execute is not enabled",
       "n1176": "cannot ACME: Host execute is not enabled",
@@ -6730,7 +7653,7 @@
       "n1590": "",
       "n1591": "Not root — useradd / systemd / nginx system paths are restricted",
       "n1592": "not seccomp requires runAsUser",
-      "n1593": "panelplease /",
+      "n1593": "Public requests / min",
       "n1594": "panelconnection; Available\"\" ( )",
       "n1595": "Panel is not running as root",
       "n1596": "Available apply:false",
@@ -6748,6 +7671,8 @@
       "n1608": "verifyinvalid",
       "n1609": "passed",
       "n1610": "Package index not refreshed (YSK_EXECUTE off) — showing apt list only; enable execute to run apt-get update",
+      "n1611": "UFW is inactive: {{n}} permanent deny rule(s) are stored in user.rules but the kernel is not enforcing them.",
+      "n1612": "UFW is inactive. A deny rule would be written to user.rules only — the kernel would not drop packets. Enable UFW first. Not enabling automatically.",
       "t0001": "listenPort invalid: {{v0}}",
       "t0002": "restoreversion {{v0}}",
       "t0003": "file (>{{v0}} bytes)",
@@ -7001,7 +7926,7 @@
       "t0251": "{{v0}} Install incomplete",
       "t0252": "{{v0}} servicestart",
       "t0253": "Start failed: {{v0}}",
-      "t0254": "Supports Node.js version {{v0}}; Availableversion: {{v1}}",
+      "t0254": "Supports Node.js version {{v0}}; available versions: {{v1}}",
       "t0255": "Supports PHP version {{v0}}; Available: {{v1}}",
       "t0256": "Supports Python version {{v0}}; Available: {{v1}}",
       "t0257": "Supports Go version {{v0}}; Available: {{v1}}",
@@ -7078,7 +8003,7 @@
       "t0328": "projectdirectory: {{v0}}",
       "t0329": "tar failed: {{v0}}",
       "t0330": "Wrotebackup {{v0}}",
-      "t0331": "dry-run: file {{v0}}+ ( {{v1}})",
+      "t0331": "Preview: {{v0}} files in the archive (showing {{v1}})",
       "t0332": "cannot: {{v0}}",
       "t0333": "restore (web) to {{v0}}",
       "t0334": "web restoreFailed: {{v0}}",
@@ -7123,20 +8048,20 @@
       "t0373": "Project \"{{v0}}\" isolation",
       "t0374": "to localpath {{v0}}",
       "t0375": "identity {{v0}}: {{v1}}",
-      "t0376": "scp (identity) to {{v0}}",
-      "t0377": "scp(identity) failed: {{v0}}",
-      "t0378": "scp to {{v0}}",
-      "t0379": "scp failed: {{v0}}",
-      "t0380": "scp to {{v0}}",
-      "t0381": "scp Failed: {{v0}} ( backup remote identityId)",
+      "t0376": "sftp (identity) to {{v0}} ok",
+      "t0377": "sftp (identity) failed: {{v0}}",
+      "t0378": "sftp to {{v0}} ok",
+      "t0379": "sftp failed: {{v0}}",
+      "t0380": "sftp to {{v0}} ok",
+      "t0381": "sftp failed: {{v0}} (set backup remote identityId)",
       "t0382": "S3 {{v0}}",
       "t0383": "S3 failed: {{v0}}",
       "t0384": ": {{v0}}/{{v1}} admin Enabled 2FA",
-      "t0385": "Policy not enforced: {{v0}}/{{v1}} admin(s) have 2FA enabled",
+      "t0385": "Policy not enforced: {{v0}}/{{v1}} admin(s) have 2FA. If there is a single admin without 2FA, enable 2FA then add a backup admin.",
       "t0386": "{{v0}} PATH",
       "t0387": "{{v0}} not found",
       "t0388": "Install {{v0}} or add it to PATH",
-      "t0389": "Availableversion: {{v0}}",
+      "t0389": "Available versions: {{v0}}",
       "t0390": "{{v0}}% ( {{v1}} MB)",
       "t0391": "{{v0}}% ({{v1}})",
       "t0392": "servicestart {{v0}}",
@@ -7379,15 +8304,15 @@
       "t0629": "project {{v0}} home: {{v1}}",
       "t0630": "project {{v0}} bind_ip={{v1}} — can ( IP )",
       "t0631": "project {{v0}} home not path: {{v1}}",
-      "t0632": "home (store ): {{v0}}",
+      "t0632": "Orphan home on disk (no matching store project): {{v0}}",
       "t0633": "Maildir: {{v0}}",
       "t0634": "{{v0}} — cannot to target",
       "t0635": "cannotprobe {{v0}}",
       "t0636": "{{v0}} · {{v1}}",
       "t0637": "project {{v0}} · {{v1}} · DB {{v2}} · Redis {{v3}}",
-      "t0638": "installsoftware {{v0}} · homes {{v1}}",
+      "t0638": "Install software {{v0}} · homes {{v1}}",
       "t0639": "cutover host {{v0}}",
-      "t0640": "Warning {{v0}} (please )",
+      "t0640": "{{v0}} warning(s) — review before cutover.",
       "t0641": "key {{v0}}",
       "t0642": "cannotkey: {{v0}}",
       "t0643": "targetnot write authorized_keys: {{v0}}",
@@ -7451,7 +8376,7 @@
       "t0701": "CDN {{v0}}",
       "t0702": "origin shield Node does not exist: {{v0}}",
       "t0703": "edges: {{v0}}",
-      "t0704": "origin URL (): {{v0}}",
+      "t0704": "Origin URL (from project bind): {{v0}}",
       "t0705": "update CDN {{v0}}",
       "t0706": "create CDN {{v0}}",
       "t0707": "origin shield: edge shield {{v0}} → {{v1}}",
@@ -7547,7 +8472,14 @@
       "t0797": "timezone failed: {{v0}}",
       "tScoreFrom": "score={{score}} from={{from}}",
       "appliedTag": " (applied)",
-      "writtenTag": " (written only)"
+      "writtenTag": " (written only)",
+      "selfDestMissing": "Cannot find the running install directory (systemd ExecStart or cli.js)",
+      "selfDestUnwritable": "Cannot write to the running install directory {{v0}}",
+      "selfApplied": "Applied {{v0}} onto {{v1}}",
+      "selfVerifyFail": "Version file after overlay does not contain {{v0}}",
+      "selfDownloadFail": "Cannot download or unpack official package {{v0}}: {{v1}}",
+      "selfOverlayFail": "Could not overlay the official package onto the running install: {{v0}}",
+      "selfUpgradeHint": "Panel apply failed. As root run: curl -fsSL https://raw.githubusercontent.com/yanshekki/ysk-server/main/install.sh | bash -s -- --upgrade"
     },
     "tpl": {
       "deleted": "Deleted {{name}}",
@@ -7610,7 +8542,7 @@
       "noParen": "(none)",
       "keepOldDb": "(kept old DB)",
       "ufwNotDetected": "UFW not detected on this host",
-      "fail2banStartHint": "Start it on the Fail2ban page",
+      "fail2banStartHint": "Start it on the fail2ban page",
       "hasExecuteNotRoot": "EXECUTE is on but process is not root",
       "notRootTarget": "Not root (target useradd/apt will be blocked)",
       "reapplyDone": "reapply key steps completed",
@@ -7739,6 +8671,8 @@
       "openvpnComing": "OpenVPN full path is staged for the next release.",
       "outlineComing": "Outline / Shadowsocks is staged for a later release.",
       "needExecuteServer": "VPN server setup requires root and YSK_EXECUTE=1.",
+      "serverStopped": "{{engine}} server stopped.",
+      "serverStopFailed": "Could not stop {{engine}} server: {{detail}}",
       "needExecuteClient": "VPN client connect requires root and YSK_EXECUTE=1.",
       "keygenFailed": "WireGuard key generation failed (is wg installed?).",
       "serverKeysCreated": "WireGuard server keys created.",
@@ -7748,6 +8682,7 @@
       "peerCreated": "Client «{{name}}» created.",
       "peerNotFound": "Client not found.",
       "peerRemoved": "Client removed.",
+      "peersSynced": "Peer list reloaded on the running WireGuard interface.",
       "setEndpointHint": "Set public endpoint (host:port) so mobile clients can reach this server.",
       "invalidConf": "Conf must include [Interface] and PrivateKey.",
       "clientImported": "Profile «{{name}}» imported.",
@@ -7816,10 +8751,12 @@
       "userdelBlocked": "Cannot remove Linux user {{user}} without root + YSK_EXECUTE",
       "userAlreadyGone": "Linux user {{user}} already absent",
       "userdelFailed": "userdel failed for {{user}}: {{detail}}",
+      "userdelLeftover": "Panel account removed, but Linux user {{user}} is still on the host. Remove it from Users or the host.",
       "userDeleted": "Removed Linux user {{user}}",
       "passwordTooShort": "VNC password must be at least 6 characters",
       "passwordWrittenOnly": "Password marked in control plane only (need root + YSK_EXECUTE for vncpasswd)",
       "passwordFailed": "Failed to write VNC password: {{detail}}",
+      "passwordNeedTiger": "vncpasswd not found. Install TigerVNC (tigervnc-standalone-server) before setting a password.",
       "passwordSet": "VNC password set for {{user}}",
       "passwordUpdated": "Password updated for {{name}}",
       "passwordMetaOnly": "Password stored as meta only until system apply",
@@ -7829,6 +8766,7 @@
       "xstartupWritten": "Wrote {{path}}",
       "sessionStartBlocked": "Cannot start VNC session without root + YSK_EXECUTE",
       "sessionStartFailed": "Failed to start display :{{display}}: {{detail}}",
+      "sessionStartHostname": "Failed to start display :{{display}}: this host cannot resolve its own hostname. Add the hostname to /etc/hosts (or fix DNS) then start the session again.",
       "sessionStarted": "Started VNC for {{user}} on :{{display}} (port {{port}})",
       "sessionStartUnverified": "Start command returned OK but RFB port not yet listening",
       "sessionAlreadyRunning": "VNC already running for {{user}} on :{{display}} (port {{port}})",
@@ -7871,7 +8809,9 @@
       "clientDeleted": "Client profile deleted",
       "sessionStartCwd": "VNC start failed: working directory not accessible to the session user (display :{{display}}). Fixed by starting from HOME.",
       "desktopRestarted": "Desktop profile applied and session restarted ({{desktop}}). Reconnect VNC/noVNC.",
-      "desktopNeedsStart": "Desktop profile {{desktop}} written to xstartup. Start the session to apply."
+      "desktopNeedsStart": "Desktop profile {{desktop}} written to xstartup. Start the session to apply.",
+      "linuxUserRolledBack": "Removed leftover Linux user {{user}} after VNC password failed.",
+      "linuxUserOrphan": "Could not remove leftover Linux user {{user}} after VNC password failed."
     },
     "apache": {
       "needServerName": "Server name required",
@@ -7921,7 +8861,64 @@
       "startedDetached": "BT tracker detached worker started (pid {{pid}}, port {{port}})",
       "runningDetached": "Tracker running as detached worker (pid {{pid}})",
       "jobQueued": "BT torrent creation queued (large share)",
-      "jobRunning": "BT torrent creation running"
+      "jobRunning": "BT torrent creation running",
+      "libraryAdded": "Added {{name}} to the WebTorrent library",
+      "libraryInspectFailed": "Could not read that .torrent or magnet",
+      "libraryDup": "That torrent is already in the library",
+      "libraryDestBad": "Save folder is not a valid Files path",
+      "libraryTorrentTooBig": ".torrent file is larger than 8 MiB",
+      "libraryNotFound": "Library item not found",
+      "libraryPaused": "Paused",
+      "libraryResumed": "Resumed",
+      "libraryRemoved": "Removed from library",
+      "libraryFilesRemoved": "Deleted downloaded files",
+      "libraryRestoreDone": "Library restore: started {{started}}/{{attempted}} (failed {{failed}})",
+      "applyTrackersDone": "Applied extra trackers to {{n}} live announce slots",
+      "libraryNeedServe": "Saved. Open the panel (ysk-server serve) so WebTorrent can download or seed.",
+      "libraryDestIsFile": "Cannot create a folder named {{name}} — a file with that name already exists.",
+      "librarySeedMissing": "No matching files in that folder to seed.",
+      "libraryWaitingPeers": "Waiting for peers. If the files are already on this host, add again and choose seed-existing."
+    },
+    "migrate": {
+      "orphanConfirm": "Type the exact leftover home path to confirm delete.",
+      "orphanStillInStore": "That home still belongs to a project in the store.",
+      "orphanMissing": "Path not on disk: {{path}}",
+      "orphanNeedExecute": "Would remove leftover {{path}}. Needs YSK_EXECUTE=1.",
+      "orphanRmFailed": "Could not remove leftover home: {{detail}}",
+      "orphanRemoved": "Removed leftover project home {{path}}."
+    },
+    "publicFiles": {
+      "liveConf": "Live Nginx conf: {{path}}",
+      "publicRoot": "Public root: {{path}}",
+      "confNameStale": "Conf file {{file}} does not match current server_name {{serverName}}. Re-apply public files to rewrite the name."
+    },
+    "leftover": {
+      "staleCliTitle": "Stale leftover CLI",
+      "staleCli": "Leftover CLI still present: {{path}} (running product {{version}}). PATH may prefer it. Remove with: rm -f {{path}}",
+      "apacheDefaultTitle": "Apache leftover default site",
+      "apacheDefault": "Apache 000-default is still enabled. That is the stock site file — it does not mean Apache is listening on public :80 (YSK Apache is expected on 127.0.0.1:8080). Overlay does not disable it. Apply Apache from the panel or hosting apache apply --execute.",
+      "nginxCatchAllTitle": "Nginx catch-all missing",
+      "nginxCatchAll": "ysk-000-default.conf is not in /etc/nginx/conf.d. Unknown SNI can fall through. Run projects nginx-sync --execute.",
+      "vsftpdTitle": "vsftpd unit failed",
+      "vsftpd": "vsftpd is failed. Overlay does not rewrite listen/listen_ipv6. Apply FTP from the panel.",
+      "dovecotTitle": "Dovecot TLS points at missing cert",
+      "dovecot": "Dovecot ssl_cert points at missing {{path}}. Overlay does not rewrite ssl=no. Apply mail TLS after issuing the cert, or apply email stack.",
+      "overlayDoesNotHeal": "Product overlay does not rewrite nginx, Apache, vsftpd, or Dovecot. Use the listed apply commands (root + YSK_EXECUTE=1).",
+      "staleCliRemoved": "Removed leftover CLI {{path}}.",
+      "staleCliRemoveFailed": "Could not remove leftover CLI {{path}}: {{detail}}",
+      "vsftpdSslOff": "Set vsftpd ssl_enable=NO because the FTPS certificate file is missing, then restarted vsftpd.",
+      "dovecotSslOff": "Set Dovecot ssl=no because {{path}} is missing, then restarted Dovecot.",
+      "readinessTitle": "Host leftovers after overlay",
+      "readinessClean": "No leftover Apache default, missing nginx catch-all, failed vsftpd, or stale CLI detected."
+    },
+    "defense": {
+      "panelReqLabel": "Panel requests / min",
+      "panelReqExcluded": "Authenticated panel traffic — shown here, not counted in threat score",
+      "tcpOk": "TCP {{target}} reachable",
+      "tcpFail": "TCP {{target}} failed",
+      "dnsDegraded": "DNS path degraded",
+      "reqRateHigh": "Public request rate {{reqs}}/min ≥ {{threshold}}",
+      "ddosHeuristic": "High public request rate plus edge probe failure"
     }
   },
   "ops": {
@@ -8072,13 +9069,16 @@
     "template": "Template (optional)",
     "templateNone": "— none —",
     "searchPlaceholder": "Search name, domain, or ID…",
+    "listDesc": "Manage sites on this host.",
     "filterAll": "All runtimes",
     "statTotal": "Total",
     "statRunning": "Running",
     "statDegraded": "Degraded",
     "statUnhealthy": "Unhealthy",
     "statStopped": "Stopped / ready",
-    "statPendingOs": "Pending OS",
+    "statStoppedOnly": "Stopped",
+    "statReadyOnly": "Ready",
+    "statPendingOs": "OS user pending",
     "status": {
       "failed": "Failed",
       "failedHint": "Deploy or health check failed — check logs",
@@ -8123,7 +9123,12 @@
       "httpStatus": "HTTP",
       "latency": "Latency",
       "error": "Error",
-      "at": "Checked at"
+      "at": "Checked at",
+      "deployMode": "Deploy mode",
+      "edgeKind": "Edge",
+      "goLiveOk": "Go-live",
+      "goLiveAt": "Go-live at",
+      "degraded": "Degraded"
     },
     "railPhp": "PHP / site",
     "railStatic": "Static site",
@@ -8137,7 +9142,16 @@
     "neverDeployed": "Never deployed",
     "created": "Created {{name}}",
     "backToList": "Back to projects",
-    "openUrl": "Open URL",
+    "openUrl": "Open site",
+    "openUrlNeedDomain": "Set a domain first — do not open 127.0.0.1 in your browser",
+    "needOsUser": "Create the system user on the Isolation tab first",
+    "goIsolation": "Open Isolation tab",
+    "homeMissing": "Home directory does not exist",
+    "homeMissingHint": "Same live probe as migrate inventory — create the system user on Isolation",
+    "stopTitle": "Stop this project (systemd unit and public site)",
+    "deployTitle": "Deploy this project",
+    "httpStatsHint": "From this project’s access log (last sample)",
+    "httpStatsNone": "No project access log yet",
     "notFound": "Project not found",
     "home": "Home directory",
     "env": "Environment",
@@ -8187,8 +9201,8 @@
     "healthUnknown": "Not checked",
     "sectionRuntimeDeploy": "Runtime deploy",
     "sectionRuntimeDeployDesc": "Start the process for this project runtime (Node / PHP)",
-    "sectionGit": "Git deploy",
-    "sectionGitDesc": "Pull from Git and redeploy",
+    "sectionGit": "Git",
+    "sectionGitDesc": "Clone, sync, and inbound push",
     "sectionEnv": "Environment variables",
     "sectionEnvDesc": "Write KEY=value lines to the project .env",
     "gitUrl": "Git URL",
@@ -8234,7 +9248,7 @@
     "nginxValuePublished": "Published",
     "nginxValueNone": "Not published",
     "osValueReady": "Ready",
-    "osValuePending": "Pending",
+    "osValuePending": "OS user pending",
     "openFiles": "Files",
     "enableCdn": "Enable CDN",
     "openLogs": "Logs",
@@ -8243,10 +9257,11 @@
     "osUserIncomplete": "System user provisioning incomplete",
     "saveLogDirsFailed": "Failed to save log directories",
     "createName": "Project name",
+    "noPathSepHint": "The name cannot contain / or \\.",
     "createRuntime": "Runtime",
     "createRuntimeHint": "You can change deploy options later in detail",
     "createVersion": "Version",
-    "createVersionHint": "Stored as runtime_version; used by deploy / FPM",
+    "createVersionHint": "Writes the project runtime version setting; deploy / FPM uses it",
     "createVersionAria": "Runtime version",
     "createPrimaryDomain": "Primary domain",
     "createPrimaryDomainHint": "Optional for now",
@@ -8390,8 +9405,16 @@
     "netHttpsDesc": "Publish Nginx after save. Full-site 301 overrides proxy/PHP/static content",
     "netForceHttps": "Force HTTPS",
     "netForceHttpsDesc": "HTTP → HTTPS (301); needs SSL cert and SSL publish",
+    "netForceHttpsOn": "HTTP will redirect to HTTPS after you publish the edge.",
+    "netForceHttpsOff": "No forced redirect is stored.",
+    "netBoundCert": "Bound certificate",
+    "netBoundCertExpiry": "expires {{at}}",
+    "netNoBoundCert": "No certificate on disk for this hostname",
+    "netForceHttpsNeedCert": "Issue a certificate on /ssl for this domain before forcing HTTPS.",
+    "netHttpsLiveNotForced": "An edge file exists; HTTPS may already work. This box only forces HTTP→HTTPS.",
     "netHsts": "Enable HSTS",
     "netHstsDesc": "Browsers stick to HTTPS (recommended after force HTTPS)",
+    "netHstsNeedHttps": "Turn on force HTTPS first",
     "netRedirectUrl": "Full-site redirect URL",
     "netRedirectHint": "Optional. Full-site 301 to this URL (move / apex→www)",
     "netBasicAuthTitle": "HTTP basic auth (browser login)",
@@ -8512,7 +9535,7 @@
     "deployPhpIniSaved": "Project php.ini overrides saved; deploy or apply FPM again",
     "deployHistory": "Deploy history ({{count}})",
     "deployHistoryDesc": "From audit; newest first",
-    "deployGitUrlHint": "HTTPS or SSH repo URL; sync then redeploy by runtime",
+    "deployGitUrlHint": "HTTPS or git@host:org/repo.git",
     "deployEnvHint": "One KEY=value per line; # comments",
     "resume": "Resume project",
     "suspend": "Suspend project",
@@ -8598,16 +9621,111 @@
     "netPublishMaint": "Maintenance",
     "sslNeedDomain": "Set a domain before publishing Nginx / SSL.",
     "createTemplateMissing": "{{v0}} ；「— —」。",
-    "deleteDialogDesc": "「{{v0}}」。。",
+    "deleteDialogDesc": "This permanently deletes “{{name}}”. It cannot be undone.",
     "deleteWillStop": "systemd / PM2 /",
     "deleteWillWeb": "Nginx conf、PHP-FPM pool、Apache vhost（）",
     "deleteWillOs": "Linux home （）",
     "deleteKeepOs": "home Linux （）",
     "deleteWillDb": "…",
     "deleteRemoveFilesDesc": "Cancel，",
-    "deleteTypeNameHint": "「{{v0}}」",
+    "deleteTypeNameHint": "「{{name}}」",
     "deleteDnsWarn": "DNS zone / domain 。",
-    "manageInNginx": "Manage in Nginx"
+    "manageInNginx": "Manage in Nginx",
+    "advFtpHomeApp": "Site app directory",
+    "advFtpHomeRoot": "Project home (full)",
+    "advFtpManage": "Open FTP page",
+    "resShell": "Login shell",
+    "resSaveHint": "Save and apply changes the live OS. Control-plane only stores the form. Re-apply uses the last saved values.",
+    "resBashConfirmTitle": "Allow interactive bash?",
+    "resBashConfirmDesc": "This grants an interactive login shell to the project user. Confirm only if you need SSH or PTY as that user.",
+    "createGitHint": "Optional. Stored on the project; clone from the Deploy tab (does not clone on create).",
+    "gitTokenLaterHint": "HTTPS token and clone depth are set on the project Deploy tab after create.",
+    "gitBranch": "Branch",
+    "gitBranchHint": "Pick a remote branch or tag.",
+    "gitBranchAfterUrl": "Enter a Git URL first. Empty uses the remote default branch.",
+    "gitLastRef": "Last sync: {{branch}} @ {{commit}}",
+    "gitConfirmTitle": "Clone into this project?",
+    "gitConfirmBody": "If app/ is still the Hello World placeholder it will be cleared, then cloned. Custom files that are not a YSK scaffold are refused.",
+    "gitConfirmRemoteBody": "This points origin at the new URL and pulls. Unrelated histories fail; custom files are not wiped.",
+    "runtimeActual": "Actual binary {{path}}",
+    "runtimeFallback": "Chosen {{version}} is not on this host. Process uses {{path}}.",
+    "gitSync": "Sync",
+    "gitFetch": "Fetch",
+    "gitCheckout": "Checkout",
+    "gitReset": "Reset to remote",
+    "gitResetNeedConfirm": "Needs confirmation — discards local commits",
+    "gitDeepen": "Fetch full history",
+    "gitLogTitle": "Recent commits",
+    "gitDirtyTitle": "Local changes block pull",
+    "gitDirtyBody": "{{count}} file(s) differ from Git (Files edits or the app). Discard them or abort.",
+    "gitSyncBlockedDirty": "Sync is disabled until local changes are discarded (Reset) or the files match Git.",
+    "gitViewDiff": "View diff",
+    "gitDiscard": "Discard local files",
+    "gitOpenFiles": "Open in Files",
+    "gitNotCloned": "Not cloned",
+    "gitClean": "Clean",
+    "gitDirty": "Dirty",
+    "gitBehind": "Behind {{count}}",
+    "gitAhead": "Ahead {{count}}",
+    "gitDetached": "Pinned",
+    "gitShallow": "Shallow",
+    "gitMissing": "git missing",
+    "gitResetConfirmTitle": "Reset hard to remote?",
+    "gitResetConfirmBody": "This discards local Git history and untracked files except .env, then restores .env from the control plane.",
+    "gitHeads": "Remote branches",
+    "gitToken": "HTTPS token",
+    "gitTokenHint": "Encrypted at rest. Never stored in the remote URL.",
+    "gitTokenPlaceholder": "ghp_… or glpat-…",
+    "gitTokenSet": "Token set",
+    "gitSaveToken": "Save token",
+    "gitClearToken": "Clear token",
+    "gitDeployKey": "Deploy public key",
+    "gitDeployKeyHint": "Add this as a read-only deploy key on the Git host.",
+    "gitDeployKeyOn": "Deploy key",
+    "gitMakeKey": "Create deploy key",
+    "gitCopyPub": "Copy public key",
+    "gitClearKey": "Clear deploy key",
+    "gitKeyCopied": "Public key copied",
+    "gitPinHost": "Pin host key",
+    "gitPinHostBody": "{{host}} is not pinned. Confirm the fingerprints, then pin before SSH clone.",
+    "gitHostUnpinned": "Host key not pinned",
+    "gitHookTitle": "Push hook",
+    "gitHookHint": "Paste the URL into GitHub / Gitea / GitLab (push only). Not Slack.",
+    "gitHookOn": "On",
+    "gitHookOff": "Off",
+    "gitHookEnable": "Enable",
+    "gitHookRotate": "Rotate secret",
+    "gitHookDisable": "Disable",
+    "gitHookSecretOnce": "Copy this secret now — it will not be shown again.",
+    "gitHookCopyUrl": "Copy",
+    "gitHookCopySecret": "Copy secret",
+    "gitHookCopied": "Copied",
+    "gitHookSetup": "Payload URL = the URL above. Content type application/json. Events: push only. Secret = the one-time value.",
+    "gitHookGithub": "Settings → Webhooks → Add webhook. Content type application/json. Events: Just the push event. GitHub.com needs HTTPS.",
+    "gitHookGitea": "Settings → Webhooks → Add Webhook → Gitea. Method POST. Event: Push.",
+    "gitHookGitlab": "Settings → Webhooks. Trigger: Push events. Secret token = hook secret (X-Gitlab-Token).",
+    "gitHookHonesty": "Host unit needs YSK_EXECUTE=1 or the hook only returns a plan.",
+    "gitHookSkipOther": "Other branches are ignored.",
+    "gitAuthHttps": "HTTPS token",
+    "gitAuthSsh": "SSH deploy key",
+    "gitLoadRefs": "Load branches",
+    "gitRefDefault": "Remote default",
+    "gitRefBranches": "Branches",
+    "gitRefTags": "Tags",
+    "gitRefOther": "Other ref…",
+    "gitRefCustom": "Commit or ref",
+    "gitRefsNeedUrl": "Enter a URL first.",
+    "gitRefsNeedAuth": "Save a token or deploy key, then load branches.",
+    "gitRefsHint": "Loaded from the remote. Choose one — do not type.",
+    "gitHookSetupToggle": "How to paste this",
+    "gitHookOneLiner": "HMAC or X-YSK-Git-Hook. Only this project’s ref.",
+    "gitHookExecuteHint": "Needs YSK_EXECUTE=1 to clone or deploy.",
+    "gitShowKey": "Show key",
+    "gitHideKey": "Hide",
+    "gitBehindShort": "↓{{count}}",
+    "gitAheadShort": "↑{{count}}",
+    "gitDirtyShort": "Dirty · {{count}}",
+    "gitFilesLink": "Files"
   },
   "protection": {
     "levels": {
@@ -8641,7 +9759,9 @@
     "note": {
       "notApplied": "Not applied on host (needs root + YSK_EXECUTE=1) — saved to panel settings",
       "nginxWritten": "Wrote Nginx rate-limit panel file",
-      "f2bWritten": "Wrote fail2ban panel settings"
+      "f2bWritten": "Wrote fail2ban panel settings",
+      "hintDropped": "Internal protection hint omitted",
+      "nginxLimits": "Will write Nginx rate-limit snippet"
     },
     "rel": {
       "justNow": "Just now",
@@ -8664,6 +9784,10 @@
     "autoBanAutomation": "Auto-ban: {{onOff}} ({{mode}})",
     "automationSaved": "Automation settings saved",
     "statFirewall": "Firewall",
+    "statSuspects": "Suspect IPs",
+    "statSuspectsSplit": "{{actionable}} actionable / {{total}} listed",
+    "suspectActionableCount": "Actionable IPs {{count}}",
+    "scoreBasisHint": "Listed suspects vs IPs you can still ban (excludes already banned / whitelist).",
     "statAutoBan": "Auto-ban",
     "statApply": "System apply",
     "statActiveBans": "Active bans",
@@ -8683,6 +9807,12 @@
     "reapply": "Re-apply",
     "nginxLimits": "Nginx rate limits",
     "notWritten": "Not written",
+    "modeValue": {
+      "normal": "Normal",
+      "degraded": "Degraded",
+      "ddos-protection": "DDoS protection",
+      "offline": "Offline"
+    },
     "mode": "Mode",
     "controlPlane": "Control plane",
     "canApply": "Can apply",
@@ -8790,6 +9920,10 @@
     "dbReady": "DB ready",
     "stale": "Stale",
     "older7d": ">7 days",
+    "freshnessNa": "n/a",
+    "freshnessMissing": "No database",
+    "freshnessStale": "Stale",
+    "freshnessFresh": "Current",
     "lastSuccess": "Last success",
     "downloaded": "Downloaded",
     "missing": "Missing",
@@ -8844,10 +9978,19 @@
     "sectionAutoBan": "② Auto-ban",
     "unban": "Unban",
     "ban": "Ban",
+    "banConfirmTitle": "Ban {{ip}}?",
+    "banConfirmDesc": "This IP will be blocked on the host. Confirm it is not a current panel or session address.",
+    "wlRemovedUndo": "Removed {{ip}} from the allow list. Undo within 5 seconds.",
+    "undo": "Undo",
+    "banSelectedConfirmTitle": "Ban {{count}} selected IPs?",
+    "banSelectedConfirmDesc": "These addresses will be blocked on the host: {{ips}}",
     "save": "Save",
     "yes": "Yes",
     "no": "No",
     "oneClickSuggested": "Apply suggested preset",
+    "stackApply": "Apply protection stack (UFW, fail2ban, preset)",
+    "stackApplyDone": "Protection stack apply requested",
+    "stackApplyHint": "This enables UFW and applies fail2ban plus the suggested preset. Confirm you will not lock yourself out of a remote panel.",
     "viewPresets": "View presets",
     "suspectIpsCount": "Suspect IPs {{count}}",
     "goBans": "Go to bans",
@@ -8903,7 +10046,12 @@
     "f2bTool": "fail2ban tool",
     "noSecondJail": "(no second jail editor here).",
     "autoBanWhitelistTitle": "Auto-ban whitelist",
-    "autoBanWhitelistDesc": "Protection auto-ban exemptions (syncs fail2ban ignoreip",
+    "autoBanWhitelistDesc": "Protection auto-ban exemptions (syncs fail2ban ignoreip).",
+    "ufwOff": "UFW (off)",
+    "ufwOffHint": "UFW is not active — fail2ban is the usable target.",
+    "whitelistSyncHint": "{{n}} panel entries · fail2ban ignoreip sync: {{sync}}",
+    "whitelistSyncOn": "on",
+    "whitelistSyncOff": "off (lists may differ)",
     "ignoreipWhitelist": "ignoreip whitelist",
     "notSetSuggestAdmin": "Not set (add your admin IP)",
     "moreItems": "… {{n}} more · see fail2ban whitelist",
@@ -8917,6 +10065,11 @@
     "fullLogsAt": "Full nginx/auth logs:",
     "logCenter": "Log center",
     "colScore": "Score",
+    "colHits": "Hits",
+    "col429": "429",
+    "topIpsTitle": "Top IPs",
+    "hitsCount": "{{n}} hits",
+    "sampleWindowHint": "Counts are from the current access + auth sample window, not the full log file.",
     "banShort": "Ban",
     "vhostLimits": "Vhost rate limits",
     "eventStream": "Event stream",
@@ -8955,7 +10108,34 @@
     "plusRegion": "+ region {{v}}",
     "plusCity": "+ city {{v}}",
     "lastTickPrefix": "· last {{t}}",
-    "nextTickPrefix": "· next {{t}}"
+    "nextTickPrefix": "· next {{t}}",
+    "cannotBanSelf": "Cannot ban {{ip}} — this is the host, your login, or ignoreip",
+    "selfIp": "This host",
+    "selfHostIp": "Host IP",
+    "selfLoginIp": "Your login IP",
+    "showZeroScore": "Show 0-score",
+    "hideZeroScore": "Hide 0-score",
+    "geoDraftOnly": "Policy is off — Save stores a draft only. Nginx will not enforce until you enable it.",
+    "geoNeedDb": "GeoIP databases are missing — update the MMDB files first",
+    "uaNeedZones": "Set a Cloudflare zone first",
+    "selectAllCountriesWarn": "Select all countries in block-list mode? That can lock out this host and your login country.",
+    "badgeRecommendPreset": "A stronger preset is recommended for the current threat",
+    "badgeAutomationOn": "Automation is on",
+    "badgeBanCount": "Active bans",
+    "badgeGeoOn": "Geo access policy is on",
+    "badgeGeoNotReady": "GeoIP database is not ready",
+    "badgeIntelSignals": "Signals that currently add score",
+    "signalActive": "Active",
+    "signalInactive": "Inactive",
+    "signalJails": "{{n}} jail(s)",
+    "dbReadyHint": "MMDB files are present",
+    "dbNotReadyHint": "Download a GeoIP database first",
+    "staleHint": "Whether the last successful update is older than 7 days",
+    "draftBadge": "Draft",
+    "banIsSelf": "This IP matches the current panel source or this host.",
+    "banNotSelf": "This IP is not the current panel source.",
+    "geoSourceLocal": "Local GeoIP library (sapics + DB-IP)",
+    "nginxPreviewHint": "Nginx snippet this preset would write (preview only):"
   },
   "publicFiles": {
     "notSet": "Not set",
@@ -8971,6 +10151,10 @@
     "siteSettings": "Site settings",
     "siteSettingsDesc": "Writes managed conf; may reload Nginx on apply (reachable only after apply)",
     "serverNameHint": "Nginx server_name, e.g. files.example.com",
+    "notes": {
+      "noManagedConf": "No managed Nginx conf yet — click Apply",
+      "notSynced": "Managed conf exists but is not under /etc/nginx/conf.d — apply again as root with YSK_EXECUTE"
+    },
     "quotaMiB": "Quota (MiB)",
     "quotaHint": "Optional; caps public directory size",
     "unlimited": "Unlimited",
@@ -8978,6 +10162,7 @@
     "appliedOk": "Public files site applied",
     "applyReload": "Apply and reload Nginx",
     "statusLive": "Live on nginx",
+    "statusDraft": "Draft / not applied",
     "statusManagedOnly": "Managed only",
     "statusNotApplied": "Not applied",
     "nginxLive": "in conf.d",
@@ -8985,9 +10170,17 @@
     "openSite": "Open site",
     "notLiveHint": "Domain 404 usually means conf is only under dataDir, not copied to /etc/nginx/conf.d, or nginx was not reloaded. Re-apply with root + YSK_EXECUTE. Use http:// until SSL is issued for this hostname.",
     "diskRoot": "Disk root",
+    "executeFlag": "Execute",
+    "asRoot": "Root",
     "filesInRoot": "Entries",
     "managedConf": "Managed conf",
-    "systemConf": "System conf.d"
+    "systemConf": "System conf.d",
+    "autoindex": "Directory listing (autoindex)",
+    "liveSystemConf": "Live system conf: {{path}}",
+    "publicRootNote": "Public root: {{path}}",
+    "applyConfirmTitle": "Apply public-files site?",
+    "applyConfirmDesc": "Write Nginx server_name {{name}} and reload Nginx.",
+    "serverNameMismatch": "Live conf uses {{live}}; the form has {{draft}}. Apply to replace."
   },
   "rbac": {
     "permissions": "Permissions",
@@ -9071,7 +10264,13 @@
       "auditExport": "Audit export",
       "securityApiKeysAdmin": "API keys admin",
       "networkBrowse": "Host-mediated web browse",
-      "networkVnc": "VNC remote desktop"
+      "networkVnc": "VNC remote desktop",
+      "validatorsRead": "Validators (read)",
+      "validatorsManage": "Validators manage",
+      "validatorsWipe": "Validators wipe data",
+      "dockerRead": "Docker (read)",
+      "dockerManage": "Docker manage",
+      "dockerWipe": "Docker wipe / prune"
     },
     "aboutRoles": "Roles (factory defaults)",
     "aboutRolesBody": "Roles set default capabilities; users can override individual ones.",
@@ -9087,7 +10286,14 @@
     "capabilitiesHint": "Toggle what this role may do",
     "enabledCount": "{{enabled}} of {{total}} enabled",
     "bandAboveMax": "Above max level",
-    "dirtyHint": "Customized (differs from factory)"
+    "roleUnavailable": "Not available for this role",
+    "dirtyHint": "Customized (differs from factory)",
+    "unsaved": "Unsaved",
+    "unsavedHint": "Unsaved edits on this role",
+    "nothingToSave": "Nothing to save",
+    "saveRole": "Save {{role}} policy",
+    "discardTitle": "Discard unsaved policy?",
+    "discardDesc": "Switching roles drops unsaved capability edits."
   },
   "readiness": {
     "cat": {
@@ -9116,12 +10322,24 @@
     "checkFailed": "Readiness check failed",
     "gatePass": "Gate passed · {{pct}}%",
     "gateFail": "Not ready · {{pct}}%",
+    "gateBlocked": "Not passed · {{n}} missing",
     "executeOn": "On",
     "executeOff": "Off",
     "blockers": "Blockers",
+    "blockersHint": "Blockers are the critical subset of Missing — not extra checks.",
+    "requireAdminTotp": "require admin 2FA policy",
+    "listenBind": "listen address",
+    "item": {
+      "admin2fa": "Admin two-factor"
+    },
+    "dataDirPerms": "panel data-directory permissions",
+    "mode750": "mode 750",
+    "totalChecks": "All checks",
+    "totalChecksHint": "Ready + degraded + missing = this total. Blockers are the critical missing subset.",
     "probing": "Probing…",
     "reprobe": "Re-probe",
     "exportReport": "Export report",
+    "exportStarted": "Downloading {{name}}",
     "firstBlocker": "Fix first blocker",
     "viewRecommended": "View recommended",
     "loadingProbe": "Probing host capabilities…",
@@ -9198,7 +10416,26 @@
     "fixNow": "Fix now",
     "fixFailed": "Fix failed",
     "fixDone": "dataDir permissions hardened (chmod 750)",
-    "fixDoneWebUi": "Web UI built / installed"
+    "fixDoneWebUi": "Web UI built / installed",
+    "rootLabel": "Superuser",
+    "techDetails": "Technical details",
+    "missingOwner": "No panel owner assigned (package quota attribution)",
+    "notOsProvisioned": "OS user pending (home not provisioned)",
+    "isolationPendingOs": "Same as project status: OS user pending. Open Isolation to provision the system user and home.",
+    "ondrejNone": "No ondrej Launchpad PHP sources detected",
+    "ondrejFound": "Found legacy ondrej/php sources that conflict with packages.sury.org: {{paths}}",
+    "ondrejTitle": "PHP apt source (ondrej residual)",
+    "systemctlActive": "Service is running",
+    "systemctlStatus": "Service status: {{status}}",
+    "binInPath": "{{bin}} in PATH",
+    "leftoverApache": "Apache leftover default site",
+    "leftoverVsftpd": "vsftpd unit failed",
+    "leftoverCli": "Stale leftover CLI",
+    "leftoverNginx": "Nginx catch-all missing",
+    "leftoverDovecot": "Dovecot TLS points at missing cert",
+    "leftoverOther": "Host leftover",
+    "leftoverApply": "Leftover apply",
+    "isolationOwnerDegrades": "Missing owner_user_id affects package quota attribution — status is degraded, not ready."
   },
   "redis": {
     "neverExpire": "Never expires",
@@ -9230,6 +10467,8 @@
     "keysCountSuffix": " · {{n}} key(s)",
     "searchPlaceholder": "Search keys, e.g. user:* or *",
     "searchKeys": "Search keys",
+    "scanHint": "Uses SCAN, not KEYS. Returns at most {{n}} keys — avoid * on huge databases.",
+    "scanCapped": "Showing the first {{n}} matches.",
     "rows": "{{n}} row(s)",
     "content": "Content",
     "noMatchingKeys": "No matching keys",
@@ -9258,6 +10497,8 @@
     "addKey": "Add key",
     "dbLabel": "DB {{i}}",
     "keysInDb": " · {{n}} key(s)",
+    "dbOptionKeys": "DB {{i}} · {{n}} keys",
+    "dbOptionEmpty": "DB {{i}} · empty",
     "dbRange": "{{n}} databases (0–{{max}}).",
     "serviceLink": "Change count in service settings",
     "dbsWithData": "DBs with data (quick)",
@@ -9266,7 +10507,21 @@
     "pickKey": "Select a key on the left to view content.",
     "ttlPrefix": "TTL: {{ttl}}",
     "writeLiveHint": "Writes live Redis; cannot undo from the panel in one click.",
-    "refPath": "Ref: {{path}}"
+    "refPath": "Ref: {{path}}",
+    "dbEmptyMark": " · empty",
+    "noRequirepass": "Protected mode is on, but requirepass is empty or unread — no password.",
+    "insecureShort": "No password",
+    "setRequirepass": "Set password",
+    "rdbOnlyLossHint": "AOF is off and RDB is on. A restart or crash can lose recent writes.",
+    "dirDataContainer": "/data (container)",
+    "dirHostDefault": "/var/lib/redis",
+    "dirDefaultInstance": "/var/lib/redis/default",
+    "dirDataWarn": "/data is usually a container path; this panel cannot confirm it exists.",
+    "saveOff": "Disable snapshots (not recommended)",
+    "saveOffWarn": "Empty save string turns RDB snapshots off. A crash can lose all data if AOF is also off.",
+    "dirMoveWarn": "Changing dir does not move dump.rdb / AOF. The next start uses the new path as-is.",
+    "passwordUnset": "Not set on the service",
+    "passwordSetHidden": "Set (not shown)"
   },
   "resources": {
     "created": "Created",
@@ -9399,6 +10654,9 @@
     "tuneLoadFailed": "Failed to load tuning",
     "availableCount": "{{n}} available",
     "notDetected": "Not detected",
+    "binaryPath": "Binary path",
+    "targetMissing": "Target not installed",
+    "targetMissingHint": "Target {{version}} is not on this host. Bind an installed version or install this pin.",
     "target": "Target",
     "tune": "Tune",
     "loadedShort": "Loaded",
@@ -9444,6 +10702,8 @@
     "demoNotBind": "(hand-typed pool name) and does not auto-bind project isolation. Global php.ini is on the php.ini tab.",
     "applyOkWritten": "Apply success = files written. Prefer project deploy so User=project Linux user.",
     "applyPhpVhost": "Apply PHP vhost / pool",
+    "applyPhpVhostTitle": "Needs confirm — writes pool/vhost files",
+    "applyPhpVhostDesc": "Will write the {{pool}} pool and {{domain}} vhost. Reload services: {{reload}}.",
     "reprobeTools": "Re-probe tools",
     "pressReprobe": "Press Re-probe tools to load",
     "installNodeLabel": "Install Node {{v}}",
@@ -9697,7 +10957,8 @@
     "tabProcesses": "Processes",
     "pm2": {
       "title": "PM2 fleet",
-      "desc": "Read-only view of pm2 jlist (panel user PM2_HOME). Live SSE refreshes every 2s.",
+      "desc": "PM2 is a process manager. This tab lists the panel user’s processes (read-only). Live updates use SSE (server-sent events) about every 2 seconds.",
+      "glossary": "PM2 = process manager; SSE = live stream.",
       "live": "Live",
       "installed": "PM2 installed",
       "version": "pm2 version",
@@ -9734,15 +10995,44 @@
       "projectsCount": "YSK projects",
       "noProjects": "No projects",
       "noProjectsDesc": "No node/bun projects in the panel, or OS user not provisioned.",
-      "pm2OnlyDesc": "Only apps started with PM2 under the panel user. systemd deploys appear above."
+      "pm2OnlyDesc": "Only apps started with PM2 under the panel user. systemd deploys appear above.",
+      "startupTitle": "Start on boot",
+      "startupDesc": "Register PM2 so processes come back after reboot.",
+      "systemdActionsHint": "systemd actions need root and YSK_EXECUTE.",
+      "startupOk": "Startup registered. {{notes}}",
+      "startupFail": "Could not register startup. {{notes}}",
+      "actionOk": "{{action}} {{name}} — {{notes}}",
+      "actionFail": "Could not {{action}} {{name}}. {{notes}}",
+      "startupReady": "Ready",
+      "startupReadyYes": "Yes",
+      "startupReadyNo": "No",
+      "startupUnit": "Unit",
+      "startupDump": "Dump",
+      "startupInstall": "Install startup",
+      "startupSave": "Save process list",
+      "actRestart": "Restart",
+      "actStop": "Stop",
+      "actReload": "Reload",
+      "pm2ActionsHint": "PM2 actions apply to the panel user’s process list only.",
+      "noteUnparsed": "PM2 list could not be parsed (empty or unexpected output).",
+      "notePanelUserOnly": "PM2 list is for the panel process user only.",
+      "noteProjectUnits": "{{n}} YSK project unit(s) listed"
     },
     "recordedInstalled": "Recorded {{v}}",
     "remoteSourceSuffix": " ({{source}})",
     "nodePathYskMissingTitle": "Managed Node path not ready",
     "nodePathYskMissing": "YSK-managed Node for version {{version}} is not ready. Re-probe or reinstall.",
+    "managedPathMissingTitle": "Managed {{name}} path not ready",
+    "managedPathMissing": "YSK-managed {{name}} for version {{version}} is not ready. Re-probe or reinstall.",
     "nodePathUnsafeTitle": "Node path is unsafe",
     "nodePathUnsafe": "Path {{path}} is outside the managed tree; project deploys may fail.",
     "recordedButProbeEmpty": "Panel recorded install {{v}}, but the host probe found no binary. Not installed — re-probe or reinstall.",
+    "installedLabel": "Installed",
+    "installedHint": "Host probe result — not the control-plane record",
+    "targetHint": "Version this page will install or pin",
+    "panelDefaultHint": "New projects prefer panel default {{version}} (host CLI may differ).",
+    "rebuildFromHost": "Rebuild record from host",
+    "rebuiltFromHost": "Record refreshed from host probe",
     "tabTuning": "Tuning",
     "versionPlaceholder": "Latest，",
     "pluginsBundleWithRuntime": "Tools「Install runtime」Install（Install）。",
@@ -9770,7 +11060,6 @@
     "setPanelDefault": "Set as panel default",
     "alreadyPanelDefault": "Panel default · {{version}}",
     "panelDefaultSaved": "Panel default set to {{version}}",
-    "panelDefaultHint": "New projects prefer panel default {{version}} (host CLI may differ).",
     "panelDefaultExplain": "Panel default = preferred version for new sites/projects. Host default = system CLI (php/python/node…).",
     "stackReadyTitle": "{{name}} stack ready",
     "softwareIntro": "Manage installed versions, host CLI default, and the version preferred for new projects.",
@@ -9788,7 +11077,20 @@
     "path": "Path",
     "fullVersion": "Full version",
     "useListForDefaults": "To change host or panel default, or remove this version, use the list above.",
-    "alreadyHostDefaultShort": "Host default"
+    "alreadyHostDefaultShort": "Host default",
+    "installRecordedCta": "Install recorded {{v}}",
+    "needsInstall": "needs install",
+    "needsInstallHint": "Not on this host. Install it first, or pick an installed version.",
+    "unitBytes": "bytes",
+    "headerSizeKb": "{{n}} KB",
+    "phpIniChipEmpty": "Not loaded — open the php.ini tab",
+    "phpFpmService": "PHP-FPM",
+    "phpFpmServiceDesc": "Start, stop, reload, or restart the PHP-FPM unit",
+    "rustupDefaultMissingTitle": "No rustup default toolchain",
+    "rustupDefaultMissing": "rustup has no default toolchain. Set one (stable) on the Software tab.",
+    "rustupDefaultMissingShort": "No default toolchain",
+    "rustupSetDefaultHint": "Set default toolchain",
+    "uninstalledCountHint": "{{n}} version(s) not on this host"
   },
   "search": {
     "placeholder": "Search pages & resources…",
@@ -9812,6 +11114,10 @@
       "cron": "Cron",
       "user": "Users",
       "other": "Other"
+    },
+    "alias": {
+      "ssl": "cert certificate certs",
+      "projects": "project sites"
     }
   },
   "security": {
@@ -9825,8 +11131,12 @@
     "pillReady": "Ready",
     "pill2faOff": "2FA off",
     "stat2fa": "2FA",
-    "statApi": "API",
+    "statApi": "API keys",
+    "statApiSessions": "API sessions",
+    "revokeOtherTitle": "Sign out {{n}} other session(s)",
     "statSsh": "SSH",
+    "statSshValue": "{{keys}} keys · {{auth}} authorized",
+    "statSshHint": "Outbound identities / authorized login keys",
     "statPending": "Pending",
     "on": "On",
     "off": "Off",
@@ -9835,7 +11145,7 @@
     "tabApiKeys": "API keys",
     "tabSsh": "SSH",
     "tabApprovals": "Approvals",
-    "tabAllowlist": "Allowlist",
+    "tabAllowlist": "Agent tools",
     "apiTokenOnce": "API token (shown once):",
     "copiedToken": "Token copied",
     "totpTitle": "Two-factor (TOTP)",
@@ -9919,8 +11229,9 @@
     "revokeAllDevices": "Revoke all devices",
     "revokedAllDevices": "All trusted devices revoked",
     "export2faBackup": "Export 2FA encrypted backup",
-    "fail2banSnippetMsg": "Fail2ban snippets: {{written}} — {{notes}}",
-    "generateFail2ban": "Generate Fail2ban snippets",
+    "fail2banSnippetMsg": "fail2ban snippets: {{written}} — {{notes}}",
+    "generatefail2ban": "Generate fail2ban snippets",
+    "generateFail2ban": "Generate fail2ban snippets",
     "adminPolicyTitle": "Admin 2FA policy",
     "adminPolicyDesc": "",
     "requireAdmin2fa": "Require admin 2FA",
@@ -9940,8 +11251,9 @@
     "apiKeysEmpty": "No API keys yet",
     "apiKeysEmptyHint": "Create from the toolbar; then call API with Bearer token",
     "approve": "Approve",
-    "allowlistTitle": "Allowlist ({{count}})",
-    "allowlistEmpty": "No allowlist tools",
+    "allowlistTitle": "Agent tools ({{count}})",
+    "allowlistEmpty": "No agent tools in the catalog",
+    "totpStatusLoadFailed": "Could not load 2FA status",
     "createApiKeyTitle": "Create API key",
     "createApiKeyDesc": "Full token is shown only once after create",
     "createKeyBtn": "Create key",
@@ -10015,7 +11327,9 @@
       "commentOptional": "Comment (optional)",
       "commentPlaceholder": "laptop / CI",
       "loginNeedProject": "Create a project first. Binding works best when the system user is ready.",
-      "loginNeedPub": "Select a project and paste a public key starting with ssh-",
+      "loginNeedPub": "Select a project or Linux user, and paste a public key starting with ssh-",
+      "loginNoProjects": "No projects. Authorize an existing Linux user (root / tester) below. Writing /root/.ssh needs YSK_EXECUTE=1.",
+      "loginLinuxHint": "Used when no project. Example: root or tester.",
       "loginAdded": "Added",
       "sshdTitle": "Project user SFTP (sshd)",
       "sshdDesc": "Let ysks_* / ysk_* project users SFTP with public keys",
@@ -10139,6 +11453,14 @@
       "ssh2faStep3": "Write home file",
       "ssh2faStep4": "Install PAM module and merge snippets (below)",
       "pkgLabel": "Package {{name}}",
+      "pkgStatus": "Package {{status}}",
+      "pamStatus": "PAM {{status}}",
+      "kbdStatus": "sshd keyboard-interactive {{status}}",
+      "light": {
+        "green": "ok",
+        "yellow": "check",
+        "red": "missing"
+      },
       "enrollForUser": "Enroll SSH 2FA for user",
       "ssh2faEmpty": "No Linux user has SSH 2FA yet",
       "ssh2faEmptyHint": "Prefer key login first;",
@@ -10183,7 +11505,13 @@
       "sharePanelTitle": "Share panel TOTP secret?",
       "sharePanelDesc": "High risk. Type SHARED to confirm.",
       "confirmString": "Confirmation string",
-      "enableShare": "Enable sharing"
+      "enableShare": "Enable sharing",
+      "invalidPub": "Paste a full OpenSSH public key line (ssh-ed25519 / ssh-rsa / ecdsa…).",
+      "dryRunOk": "Dry-run finished. Review the preview below.",
+      "strictDryRun": "Strict preview (dry-run)",
+      "errorNoDetail": "Test failed (no details)",
+      "strictBlocked": "Package or PAM is not ready; Strict apply is disabled.",
+      "privCloseWithoutAck": "Closed. The private key will not be shown again; generate a new one if you did not save it."
     },
     "sessionsActive": "Active sessions",
     "sessionsOther": "Other devices",
@@ -10206,7 +11534,44 @@
     "revokeOthersDesc": "This will end {{count}} other session(s). Your current browser stays signed in.",
     "sessionRevoked": "Session signed out",
     "mySecurityHint": "",
-    "policyTotpHint": "Site policy: each admin must enable their own 2FA (individual QR)"
+    "policyTotpHint": "Site policy: each admin must enable their own 2FA (individual QR)",
+    "requireUser2fa": "Require 2FA for all panel users",
+    "changePasswordTitle": "Change sign-in password",
+    "currentPassword": "Current password",
+    "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
+    "passwordMismatch": "New passwords do not match.",
+    "changePassword": "Change password",
+    "passwordChanged": "Password updated.",
+    "strictNeedsEnrolled": "Enable 2FA on this admin account before turning on Strict.",
+    "policyTotpNeedSelf": "Enable 2FA on this account first; the confirm code cannot be filled otherwise.",
+    "policyNoTotpHint": "This account has no 2FA yet. Turn on 2FA above before requiring it for admins or all users — otherwise you can lock everyone out.",
+    "policyNeedSelf2fa": "Enable 2FA on this account first, then confirm with a TOTP code",
+    "revokeAllDevicesTitle": "Revoke every remembered device — you and other admins must verify 2FA again",
+    "sessionCli": "CLI",
+    "sessionApi": "API",
+    "fail2banSnippetTitle": "fail2ban snippet",
+    "fail2banSnippetEmpty": "No snippet was written.",
+    "trustedDevicesTitle": "Trusted devices",
+    "noTrustedDevices": "No trusted devices.",
+    "strictConfirmTitle": "Turn on Strict 2FA?",
+    "strictConfirmDesc": "Users without 2FA will be refused sign-in. Confirm you already have a working TOTP or passkey.",
+    "revokeDevicesTitle": "Revoke trusted devices?",
+    "revokeDevicesDesc": "Remembered browsers will need 2FA again.",
+    "approvalsHint": "Approvals appear when a high-risk tool needs a second operator. Grant Review approvals and Handle approvals on Users → Permissions.",
+    "allowlistReadonly": "Read-only catalog of agent tools. Capability grants are configured on Users → Permissions.",
+    "colTool": "Tool",
+    "colAllowed": "Allowed",
+    "colRisk": "Risk",
+    "colApproval": "Approval",
+    "risk": {
+      "low": "Low",
+      "medium": "Medium",
+      "high": "High",
+      "critical": "Critical"
+    },
+    "confirmDeleteApiKey": "Delete this API key?",
+    "confirmDeleteApiKeyDesc": "“{{name}}” will stop authenticating. This cannot be undone."
   },
   "serviceExposure": {
     "title": "Network access",
@@ -10217,11 +11582,22 @@
     "modePrivate": "Local only",
     "modePublic": "Public",
     "modeRestricted": "Restricted",
+    "modeUndecided": "Not set",
+    "modePublicLive": "Public (live bind)",
+    "summaryPublicLive": "Listening on {{bind}} — reachable on all interfaces. Confirm access mode; this is not private.",
+    "modeLoading": "Loading",
     "summaryPrivate": "Not open on the public firewall.",
     "summaryPublic": "Open · {{ports}}",
+    "summaryUndecided": "Access mode not confirmed (catalog default: {{suggested}}).",
+    "summaryNotEnforced": "Firewall is off — the panel is not opening or blocking these ports.",
+    "roleSmtp": "SMTP submission",
+    "roleImap": "IMAP / POP3 mailbox",
     "summaryRestricted": "Restricted · {{count}} source(s)",
     "summaryFirewallOff": "Host firewall: {{detail}} — rules not enforced until UFW is active.",
+    "summaryFirewallOffOnly": "Host firewall is not enabled, so port rules are not enforced.",
     "outOfSync": "Out of sync",
+    "openButStopped": "Ports open — service not running",
+    "openNoTenants": "Public ports with no tenants",
     "firewallOff": "Firewall off",
     "ufwMissing": "UFW not installed",
     "ufwInactive": "inactive",
@@ -10237,18 +11613,76 @@
     "restrictedNeedSource": "Add at least one IP/CIDR or country code for restricted mode.",
     "privateStartTitle": "Expose {{service}} on the network?",
     "confirmAndStart": "Confirm and start",
-    "cloudSgNote": "Host firewall only — cloud security groups (AWS/GCP/Azure) are not changed."
+    "cloudSgNote": "Host firewall only — cloud security groups (AWS/GCP/Azure) are not changed.",
+    "serviceNotInstalled": "This service is not installed, so firewall rules do not apply."
   },
   "services": {
     "enabledBoot": "On boot",
+    "unitNotFound": "Not installed",
+    "bootNa": "Not applicable",
+    "unitNa": "Not applicable",
+    "permLabel": "Permission",
+    "permCanChange": "Can change the system (superuser)",
+    "permBlocked": "Cannot change the system",
+    "permHint": "System change {{exec}} · Superuser {{root}}",
+    "clusterLegend": "Planned = saved in the panel, not applied on the host.",
+    "active": {
+      "active": "Running",
+      "inactive": "Stopped",
+      "not-found": "Not installed",
+      "failed": "Failed",
+      "tool": "Tool",
+      "activating": "Starting"
+    },
+    "unitStatic": "static",
+    "unitIndirect": "indirect",
     "action": {
       "start": "Start",
       "stop": "Stop",
       "restart": "Restart",
-      "reload": "Reload"
-    },
+      "reload": "Reload",
+      "enable": "Enable on boot",
+      "disable": "Disable on boot"
+    },
+    "enabledOk": "{{label}} enabled on boot",
+    "bootDisabledWarn": "{{label}} is running but will not start at boot. Enable it to persist across reboot.",
+    "bootDisabledShort": "Not on boot",
+    "sshdBootOffWarn": "sshd is not enabled on boot. After reboot this host will have no SSH rescue path.",
+    "mariadbNotInstalled": "MariaDB is not installed",
+    "mariadbNotInstalledMysqlOk": "Not installed: MariaDB (MySQL is installed)",
+    "lifecycleTitle": "{{label}} service control",
+    "startedOk": "{{label}} started",
+    "stoppedOk": "{{label}} stopped",
+    "needRunning": "{{label}} is not running",
+    "restartedOk": "{{label}} restarted",
+    "reloadedOk": "{{label}} reloaded",
+    "stopNeedConfirm": "Needs confirmation",
+    "stopNeedConfirmPhrase": "Needs confirmation phrase",
+    "stopConfirmTitle": "Stop {{label}}?",
+    "stopConfirmDesc": "{{label}} will stop listening. Start it again from this page when needed.",
+    "stopConfirmEdgeDesc": "Stopping {{label}} takes sites and reverse-proxy traffic offline until it is started again.",
+    "stopConfirmEdgeConsequence": "HTTP/HTTPS on this host will not be served while {{label}} is stopped.",
+    "stopConfirmSshdTitle": "Stop sshd?",
+    "stopConfirmSshdDesc": "Stopping sshd closes remote SSH. Confirm you still have a console or another login path.",
+    "stopConfirmSshdToken": "stop sshd",
+    "stopConfirmSshdConsequence": "New SSH sessions will fail until sshd is started from the host console.",
+    "stopConfirmPanelTitle": "Stop YSK Server?",
+    "stopConfirmPanelDesc": "The panel and API will go offline until the unit is started on the host.",
+    "restartConfirmPanelTitle": "Restart YSK Server?",
+    "restartConfirmPanelDesc": "The panel and API will drop briefly while the unit restarts.",
+    "stopConfirmPanelToken": "stop ysk-server",
+    "stopConfirmPanelConsequence": "This browser session will disconnect. Start the unit from SSH or the host console.",
+    "stopConfirmFail2banTitle": "Stop fail2ban?",
+    "stopConfirmFail2banDesc": "Stopping fail2ban turns off automatic IP bans. Websites and SSH keep running.",
+    "stopConfirmFail2banConsequence": "New attackers are not banned until fail2ban is started again.",
     "actionDone": "{{action}} done",
     "runningOf": "{{running}}/{{total}} running",
+    "statusFilter": {
+      "all": "All states",
+      "running": "Running",
+      "failed": "Failed",
+      "missing": "Not installed"
+    },
     "canMutate": "Mutable",
     "locked": "Locked",
     "controlUnit": "Control-plane unit",
@@ -10262,7 +11696,7 @@
     "matrixTab": "Service matrix ({{count}})",
     "stackTab": "Software stack",
     "stackTitle": "Host software stack",
-    "stackHint": "Install or remove host components by plan; SQL server engines are exclusive.",
+    "stackHint": "Software plans install OS packages. The service matrix tab lists systemd units — the two counts are not the same set.",
     "protectionTab": "Protection probe",
     "knownServices": "Known services",
     "showing": "Showing {{shown}} / {{total}}",
@@ -10272,6 +11706,7 @@
     "bootPrefix": "Boot {{state}}",
     "controlPage": "Control page",
     "manageRuntime": "Install / update",
+    "installOrOpen": "Install / open",
     "protectionTitle": "Protection probe",
     "protectionSub": "Read-only; does not change firewall / fail2ban",
     "protectionDoneNote": "Protection probe finished",
@@ -10368,7 +11803,8 @@
       "pick": "Pick version",
       "noTarget": "No update target",
       "needRuntimePage": "Install this version on the runtime page",
-      "noAptCandidate": "No apt candidate version"
+      "noAptCandidate": "No apt candidate version",
+      "sourceLabel": "Source"
     },
     "install": {
       "progress": "Installing: {{list}}…",
@@ -10465,6 +11901,8 @@
       "vnc": "VNC services will stop",
       "controlPlane": "Control plane runtime (protected)",
       "generic": "Related services may stop",
+      "containers": "Running containers will stop",
+      "validators": "Validator node stacks that use Docker Compose will stop",
       "purgeData": "Data paths will be deleted",
       "protectedSkipped": "Protected components are skipped",
       "runtimeStack": "All panel-managed versions of this runtime will be removed"
@@ -10474,7 +11912,15 @@
     "dockCancelling": "Cancelling · {{title}}",
     "dockCancelled": "Cancelled · {{title}}",
     "cancelHint": "Cancel requested. The client stopped listening; the host may finish the current apt/step. Re-probe status after a moment.",
-    "cancelledToast": "Operation cancelled (client stopped streaming)"
+    "cancelledToast": "Operation cancelled (client stopped streaming)",
+    "kindApply": "Apply",
+    "kindScan": "Scan",
+    "kindDeploy": "Deploy",
+    "kindRuntime": "Runtime",
+    "jobDone": "Finished · {{title}}",
+    "jobFailed": "Failed · {{title}}",
+    "uninstallUfwWarn": "Removing UFW leaves this host without its panel-managed port firewall.",
+    "uninstallFail2banWarn": "Removing fail2ban stops jails and releases current bans. Add your login IP to ignoreip first if you keep it."
   },
   "sqlEngineHealth": {
     "finding": {
@@ -10607,6 +12053,8 @@
     },
     "pillCount": "{{count}} cert(s)",
     "statCerts": "Certificates",
+    "panelCertHint": "Panel HTTPS uses {{path}} (expires {{exp}}). It is not listed as a site certificate.",
+    "openPanelTls": "Open panel HTTPS",
     "statWithFiles": "With files",
     "statBindings": "Bindings",
     "statFailed": "Failed",
@@ -10662,6 +12110,9 @@
     "filesYes": "Yes",
     "filesNo": "No",
     "colExpires": "Expires",
+    "renew": "Renew",
+    "renewFor": "Renew {{domain}}",
+    "deleteDomain": "Delete {{domain}}",
     "colStatus": "Status",
     "emptyTitle": "No certificates yet",
     "emptyDesc": "Use “Upload certificate” or “Request Let’s Encrypt” above",
@@ -10684,17 +12135,27 @@
     "leHttp01Hint": "Normal domains use http-01 (nginx plugin)",
     "deleteTitle": "Delete certificate?",
     "deleteDesc": "Removes cert files and registration for {{domain}}.",
+    "deleteNeedDomain": "Delete this certificate — type the domain name to confirm",
     "savedCert": "Saved certificate for {{domain}}",
     "uploadFailed": "Upload failed",
     "requestBlocked": "Cannot complete certificate request in the admin panel",
     "requestDone": "Certificate request completed",
     "requestFailed": "Certificate request did not succeed",
     "applyFailed": "Request failed",
-    "deletedCert": "Deleted {{domain}}"
+    "deletedCert": "Deleted {{domain}}",
+    "uninstallCertbotWarn": "Removing certbot stops automatic renewal of existing Let's Encrypt certificates.",
+    "uninstallCertbot": "Uninstall certbot (loses auto-renew)",
+    "domainRequired": "Please enter a domain.",
+    "domainInvalid": "Domain format is not valid.",
+    "domainKnownHint": "Pick a known project, DNS, or mail domain, or type a custom name."
   },
   "stackWizard": {
     "purgeConfirm": "Confirm purge? Registered data paths (databases/mail) will be deleted permanently.",
-    "installedCount": "Installed {{installed}} · Missing {{missing}}",
+    "installedCount": "Packages installed {{installed}} · missing {{missing}}",
+    "countHint": "These counts are OS packages in the software plan — not the service-matrix units on the other tab.",
+    "executeRoot": "System changes {{execute}} · administrator {{root}}",
+    "manifestPlan": "Plan {{plan}} ({{bundles}})",
+    "manifestHint": "Last chosen software plan and bundles",
     "needRootExecute": "Live install/remove needs administrator rights and system-change permission. You can still dry-run.",
     "modeInstall": "Install plan",
     "modeUninstall": "Uninstall",
@@ -10709,7 +12170,10 @@
     "dataPolicy": "Data policy",
     "keepData": "Keep data",
     "purgeData": "Purge data",
-    "uninstallNow": "Uninstall now"
+    "uninstallNow": "Uninstall now",
+    "uninstallNeedSelect": "Select at least one bundle. Empty selection no longer means remove all.",
+    "uninstallConfirmTitle": "Remove selected bundles?",
+    "uninstallConfirmDesc": "{{count}} bundle(s) will be removed. Type REMOVE to confirm."
   },
   "support": {
     "title": "Support",
@@ -10737,7 +12201,23 @@
     "cryptoNetwork": "Network",
     "cryptoAddress": "Address",
     "copy": "Copy",
-    "copied": "Copied"
+    "copied": "Copied",
+    "copyTitle": "Copy {{address}}",
+    "docsLink": "Documentation",
+    "diagTitle": "Diagnostic summary",
+    "diagBody": "Copy version, system-change, superuser, and host facts to paste into an email. This is not a full log bundle.",
+    "diagCopy": "Copy diagnostic summary",
+    "diagCopied": "Diagnostic summary copied",
+    "diagCopyTitle": "Copy version, system-change, and host facts",
+    "diagPreview": "Preview what will be copied",
+    "diagLoading": "Loading diagnostic…",
+    "diagLoadFailed": "Could not load diagnostic",
+    "copiedAddr": "Copied {{addr}}",
+    "diagStatus": "Status",
+    "diagMode": "Mode",
+    "diagProtection": "Protection",
+    "diagHostname": "Hostname",
+    "diagOs": "OS"
   },
   "system": {
     "exportLoadFailed": "Failed to load export data",
@@ -10769,7 +12249,10 @@
     "prettyPh": "Friendly display name",
     "timezone": "Timezone",
     "timezoneHint": "Choose an IANA timezone from the list (e.g. Asia/Hong_Kong)",
+    "timezoneNow": "Host time now: {{time}} ({{tz}})",
+    "timezoneBrowserDiff": "This host uses {{host}}; your browser uses {{browser}}. Changing timezone here changes the host clock, not the browser.",
     "timezoneSelect": "Select timezone",
+    "notExported": "Not exported yet",
     "dns": "DNS",
     "updated": "Updated",
     "applyIdentity": "Apply identity",
@@ -10780,9 +12263,9 @@
     "panelSsl": "Panel SSL",
     "panelTls": {
       "title": "Panel HTTPS",
-      "sub": "Control plane (ysk-server) serves TLS on listenPort; WebAuthn/Passkeys need HTTPS",
+      "sub": "Control plane (ysk-server) serves TLS on the configured port; WebAuthn/Passkeys need HTTPS",
       "domain": "Panel domain",
-      "domainHint": "Used for certificate issue/bind, e.g. demo.ysk.hk",
+      "domainHint": "Used for certificate issue/bind, e.g. {{host}}",
       "email": "Let’s Encrypt email",
       "status": "Status",
       "enabled": "TLS enabled in config",
@@ -10794,6 +12277,7 @@
       "issueEnable": "Issue cert & enable HTTPS",
       "enableExisting": "Enable with existing cert",
       "disable": "Disable panel HTTPS",
+      "disableNeedConfirm": "Needs confirmation — type DISABLE-HTTPS",
       "needDomain": "Enter hostname / domain first",
       "urlHint": "After restart open {{url}}",
       "certMissing": "TLS enabled but cert/key files missing",
@@ -10818,7 +12302,16 @@
       "leOk": "Let’s Encrypt certificate obtained for {{domain}}",
       "leFailed": "Certificate request failed: {{detail}}",
       "leHint": "Ensure DNS A points here and port 80 is reachable (or nginx serves the domain)",
-      "openFirewall": "If public: allow panel port {{port}}/tcp (Firewall → open port → 9287 Panel)"
+      "openFirewall": "If public: allow panel port {{port}}/tcp (Firewall → open port → 9287 Panel)",
+      "disableConfirmTitle": "Disable panel HTTPS?",
+      "disableConfirmDesc": "The panel will serve HTTP. WebAuthn / Passkey will stop working until HTTPS is on again.",
+      "disablePasskeyWarn": "Registered passkeys need HTTPS — they will fail on HTTP.",
+      "listenPublic": "Panel is listening on a public address (0.0.0.0/::). Restrict with a firewall or bind to 127.0.0.1.",
+      "bootstrapCert": "This is the self-signed bootstrap certificate — browsers will warn. Issue a trusted certificate for the panel domain.",
+      "cliNoSocket": "CLI has no live HTTP socket; servingHttps is inferred from config and listen sockets (ss).",
+      "listenHost": "Listen address",
+      "currentHost": "This session",
+      "replaceCert": "Replace with a trusted certificate"
     },
     "timeNtp": "Time & NTP",
     "clockStatus": "System clock status",
@@ -10860,6 +12353,9 @@
     "powerTitle": "Power (danger zone)",
     "powerWarn": "Reboot/poweroff interrupts all services and the panel. The panel cannot power the host on — needs physical access or hypervisor.",
     "unlocked": "Unlocked",
+    "powerUnlock": "Unlock danger zone",
+    "powerLock": "Lock danger zone",
+    "noScheduledPower": "No reboot or poweroff is scheduled",
     "powerCaps": "Needs YSK_EXECUTE=1 and root. Now EXECUTE={{exec}}, root={{root}}.",
     "scheduledPower": "Scheduled poweroff/reboot detected",
     "cancelScheduleHint": ". Use “Cancel schedule” to withdraw.",
@@ -10901,6 +12397,7 @@
     "syncToSystem": "Sync to system",
     "syncSub": "Copy to /etc/nginx/conf.d and reload — needs root + EXECUTE",
     "syncReload": "Sync + reload",
+    "syncReloadNeedConfirm": "Needs confirmation — writes /etc/nginx/conf.d and reloads Nginx",
     "exportOnly": "Export only + list conf",
     "dryRun": "Dry-run",
     "dryRunNote": "Dry-run does not change the system.",
@@ -10914,8 +12411,8 @@
     "syncConfirmDesc": "Sync managed Nginx conf to /etc/nginx/conf",
     "uptime": "Uptime",
     "load1m": "Load 1m",
-    "executeLabel": "EXECUTE",
-    "rootLabel": "Root",
+    "executeLabel": "System change",
+    "rootLabel": "Superuser",
     "managedLabel": "Managed",
     "managedCount": "Managed",
     "exportsCount": "Exports",
@@ -10923,7 +12420,14 @@
     "exportPath": "Export path",
     "mode": "Mode",
     "managedConf": "Managed conf",
-    "dryRunFlag": "Dry-run"
+    "dryRunFlag": "Dry-run",
+    "timezoneSearch": "Filter timezones…",
+    "resyncNtp": "Re-sync NTP",
+    "storageSub": "Disk usage",
+    "nginxLeftover": "Leftover",
+    "nginxUnused": "Unused",
+    "nginxLeftoverHint": "Stale public-files or leftover conf. Still included in sync until you remove or replace it.",
+    "nginxUnusedHint": "Stock / catch-all conf (000-default). Still included in sync until you act."
   },
   "systemd": {
     "enabled": "Enabled",
@@ -10997,6 +12501,8 @@
     "policyNotEqualFull": "Write template ≠ service enabled ≠ listening",
     "controlPlaneUnit": "Control-plane unit",
     "kpiRuntime": "Runtime",
+    "rawStateHint": "Raw unit state in tooltip",
+    "bootHint": "Whether the unit starts at boot",
     "kpiBoot": "Boot enable",
     "kpiCaps": "Apply capability",
     "capsReady": "Can install to system",
@@ -11042,8 +12548,12 @@
     "error": "Terminal error",
     "wsError": "WebSocket failed",
     "exitCode": "Exit code {{code}}",
-    "needRootExecute": "Requires root + YSK_EXECUTE=1 for system shells.",
+    "needRootExecute": "System shells need superuser and system-change permission.",
+    "groupSystem": "System",
+    "groupProject": "Project",
     "unavailable": "unavailable",
+    "copyAll": "Copy all",
+    "copyAllNeedConn": "Connect first — the buffer is empty while disconnected",
     "placeholder": "Pick an identity, then Connect",
     "aboutTitle": "About terminal",
     "aboutSub": "Interactive OS shell in the browser (local users). Not an arbitrary remote SSH client.",
@@ -11057,7 +12567,11 @@
     "stepUpHint": "Root login requires 2FA step-up when your account has TOTP enabled.",
     "stepUpTitle": "Confirm root shell",
     "stepUpDesc": "Enter your authenticator code or a recovery code.",
-    "totpLabel": "TOTP / recovery code"
+    "totpLabel": "TOTP / recovery code",
+    "sessionStillOpen": "A live shell is still connected while you read this page.",
+    "rootConfirmTitle": "Open a root shell?",
+    "rootConfirmDesc": "This session is an unrestricted root PTY on the host. Commands are audited.",
+    "rootConfirmBody": "Only continue if you intend to run privileged host commands."
   },
   "uiInline": {
     "s27d9daa5": "runtime {{v0}} {{v1}}，",
@@ -11287,6 +12801,7 @@
     "highRiskN": "{{count}} high-risk",
     "panelUpdate": "Panel update available",
     "riskOk": "Risk manageable",
+    "riskUnevaluated": "Not evaluated — run Scan + OSV",
     "pendingScan": "Awaiting scan",
     "packages": "Packages",
     "highRisk": "High risk",
@@ -11297,6 +12812,7 @@
     "reload": "Reload",
     "osvTitle": "Query OSV for top 12 suggested packages (needs network)",
     "scanOsv": "Scan + OSV",
+    "cveNotChecked": "Not checked",
     "scanPkgs": "Scan packages",
     "tabInventory": "Package inventory",
     "tabSelf": "Panel self",
@@ -11345,6 +12861,8 @@
     "policyTitle": "Update policy",
     "policyBody": "High-risk and CVE packages require approval before apply",
     "applyPkg": "Apply package upgrade",
+    "rebootNeeded": "reboot",
+    "kernelRebootHint": "Kernel packages need a reboot after apply",
     "applyPkgConfirm": "Upgrade {{name}}?",
     "applyPkgDesc": "Runs apt upgrade for this package on the host. Needs root + YSK_EXECUTE.",
     "lastScan": "Last scan",
@@ -11355,11 +12873,12 @@
     "selfCurrentShort": "Current",
     "selfLatestShort": "Latest",
     "applyPanelUpdate": "Apply panel update",
+    "applyPanelAlreadyLatest": "Already the latest panel version",
     "recheck": "Recheck",
     "aboutScope": "Scope",
-    "aboutScopeV": "ysk-server control-plane version · not full-system apt upgrade",
+    "aboutScopeV": "ysk-server panel + catalog services + runtimes + remaining apt packages",
     "aboutChannel": "Channel",
-    "aboutChannelV": "npm → GitHub release → package.json; apply via npm install -g or git (YSK_SOURCE_ROOT)",
+    "aboutChannelV": "npm package ysk-server → GitHub release → apps/server/package.json; apply: npm i -g ysk-server@version or git (YSK_SOURCE_ROOT)",
     "aboutFail": "Failures",
     "aboutFailV": "Unavailable channels are not reported as up-to-date; apply needs EXECUTE; git apply needs service restart",
     "jobsTitle": "Scheduled jobs",
@@ -11370,7 +12889,52 @@
     "scanPolicy": "Scan",
     "scanPolicyV": "Scan ≠ upgraded; apply changes the system",
     "highRiskPolicy": "High risk",
-    "highRiskPolicyV": "Needs approval: second confirm before send",
+    "highRiskPolicyV": "Needs approval: the Apply button opens a confirm dialog before anything is sent",
+    "needApprovalHint": "Open Available and filter to packages that need approval",
+    "applyNeedConfirm": "Opens a confirm dialog before applying",
+    "probeFailed": "Probe failed",
+    "notViaApt": "Not managed by apt — no candidate",
+    "noCandidate": "No candidate from package manager",
+    "cveLabel": "CVE",
+    "jobOpenGeo": "GeoIP page",
+    "job": {
+      "protection_probe": {
+        "name": "Protection probe",
+        "hint": "Periodic defense signals"
+      },
+      "updates_scan": {
+        "name": "Updates scan",
+        "hint": "Refresh package inventory"
+      },
+      "daily_backup": {
+        "name": "Daily backup",
+        "hint": "Scheduled backup all"
+      },
+      "db_temp_expire": {
+        "name": "Expire temp DB users",
+        "hint": "Drop expired temporary database users"
+      },
+      "defense_auto_ban": {
+        "name": "Defense auto-ban",
+        "hint": "Apply auto-ban tick"
+      },
+      "defense_geoip_update": {
+        "name": "GeoIP update",
+        "hint": "Download GeoIP databases"
+      },
+      "log_auto_vacuum": {
+        "name": "Log vacuum",
+        "hint": "journald retention"
+      },
+      "email_dnsbl": {
+        "name": "Email DNSBL",
+        "hint": "Mail DNSBL check"
+      },
+      "validators_upgrade_scan": {
+        "name": "Validators upgrade scan",
+        "hint": "Check validator image / binary updates"
+      }
+    },
     "permPolicy": "Permissions",
     "permPolicyV": "Without EXECUTE/root → blocked (no fake success)",
     "osvPolicyV": "Needs network; enriches top 12 suggestions only",
@@ -11395,6 +12959,9 @@
     "updateFailed": "Update failed",
     "updateIncomplete": "Update incomplete",
     "appliedUpdate": "Update applied",
+    "panelRestarting": "Panel is restarting to load the new version…",
+    "panelRestarted": "Panel is back · {{version}}",
+    "panelRestartWait": "Panel apply finished. If this page does not refresh, reload after a few seconds.",
     "aptCandidate": "apt Candidate",
     "advice": {
       "update": "Update recommended",
@@ -11436,7 +13003,26 @@
     "scanNow": "Scan now",
     "viewUpgradable": "View upgradable",
     "installElsewhere": "To install packages (Nginx, PHP, databases…), open the matching feature page — not this hub.",
-    "status": "Status"
+    "status": "Status",
+    "groupService": "Services",
+    "groupRuntime": "Runtimes",
+    "groupOs": "System packages",
+    "notInstalled": "Not installed",
+    "goToPage": "Open page",
+    "hubHint": "Catalog software and runtimes on this host. Scan to refresh.",
+    "intervalDay": "every day",
+    "intervalDays": "every {{n}} days",
+    "intervalHour": "every hour",
+    "intervalHours": "every {{n}} hours",
+    "intervalMinutes": "every {{n}} minutes",
+    "intervalSeconds": "every {{n}} seconds",
+    "availableHint": "Packages with a newer candidate from the package manager.",
+    "servicesHint": "Catalog services on this host. Open the service page to install.",
+    "runtimeHint": "Runtimes on this host. Version upgrades are done on each runtime page.",
+    "needsReboot": "Reboot needed",
+    "kernelRebootWarn": "Installing a new kernel usually needs a reboot before it is used.",
+    "neverRun": "not run yet",
+    "scanOsvN": "Scan + OSV (first {{n}})"
   },
   "users": {
     "userCount": "{{count}} users",
@@ -11444,12 +13030,17 @@
     "packages": "Packages",
     "suspended": "Suspended",
     "securityCenter": "Security center",
+    "singleAdminNo2fa": "This host has a single admin and 2FA is off. Enable admin 2FA under Security, then add a backup admin on this page.",
+    "enableAdmin2fa": "Enable admin 2FA",
+    "addBackupAdmin": "Add a backup admin",
     "loading": "Loading users & packages…",
     "userList": "Users ({{count}})",
     "userListDesc": "Open detail to edit role, password, package, overrides",
     "createUser": "Create user",
+    "operatorHighRiskHint": "The factory operator role includes high-risk writes (services, firewall, package apply, MySQL, Nginx publish). Narrow it only if you intend to change every existing operator.",
     "createUserPlus": "+ Create user",
     "searchPh": "Username / role / package",
+    "searchPkgPh": "Package name",
     "searchUsersAria": "Search users",
     "user": "User",
     "roles": "Roles",
@@ -11459,6 +13050,9 @@
     "resume": "Resume",
     "suspend": "Suspend",
     "impersonate": "Impersonate",
+    "impersonateHint": "Opens a session as this user. Use the account menu to leave impersonation.",
+    "cannotDeleteSelf": "You cannot delete the signed-in account",
+    "cannotImpersonateSelf": "You are already signed in as this account",
     "openDetail": "Details",
     "edit": "Edit",
     "resetPassword": "Reset password",
@@ -11558,7 +13152,283 @@
     "securityClearTotpHint": "Requires step-up",
     "securityClearConfirm": "Type the username to confirm clearing 2FA",
     "securityClearOk": "Cleared 2FA for {{name}}",
-    "securitySelfNote": "To set up your own 2FA, open Security → My security."
+    "securitySelfNote": "To set up your own 2FA, open Security → My security.",
+    "cannotModifySelf": "You cannot suspend or demote the signed-in account",
+    "cannotDeleteLastAdmin": "Cannot delete the last admin",
+    "cannotDemoteLastAdmin": "Cannot suspend or demote the last admin",
+    "lockSelfHint": "This is the signed-in account. Delete, suspend, and role change are blocked to prevent lock-out.",
+    "lockLastAdminHint": "This is the last admin. Delete, suspend, and demotion are blocked.",
+    "demoteAdminTitle": "Demote this admin?",
+    "demoteAdminDesc": "This user will lose full admin access. Confirm only if another admin remains.",
+    "quotaNonNeg": "Counts and quotas cannot be negative.",
+    "diskQuotaHint": "Presets are GiB; custom box is MiB.",
+    "bandwidthHint": "0 means unlimited."
+  },
+  "validators": {
+    "title": "Validators (Beta)",
+    "subtitle": "Install and manage L1 nodes on this host. Non-custodial — you keep the keys.",
+    "beta": "Beta",
+    "tab": {
+      "nodes": "Nodes",
+      "disk": "Disk",
+      "about": "About"
+    },
+    "empty": {
+      "title": "No validator nodes yet",
+      "desc": "Create a testnet node in a few clicks."
+    },
+    "refresh": "Refresh",
+    "disk": {
+      "title": "Validator disk",
+      "root": "Data directory",
+      "free": "Free",
+      "used": "Used",
+      "none": "No instance data yet",
+      "warn": "Disk usage is high (70%+)",
+      "danger": "Disk usage is critical (85%+)",
+      "autoClear": "Auto-clear the largest stopped instance when disk is critical (off by default)",
+      "autoClearRisk": "Destructive: the largest stopped instance is deleted without a further prompt. Default is off. Check audit / logs after it fires.",
+      "autoClearConfirmTitle": "Enable auto-clear?",
+      "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again."
+    },
+    "chain": {
+      "eth": "Ethereum",
+      "avax": "Avalanche",
+      "near": "NEAR",
+      "ada": "Cardano",
+      "btc": "Bitcoin",
+      "cosmos": "Cosmos Hub",
+      "sui": "Sui",
+      "aptos": "Aptos",
+      "dot": "Polkadot",
+      "sol": "Solana"
+    },
+    "network": {
+      "hoodi": "Hoodi",
+      "sepolia": "Sepolia",
+      "mainnet": "Mainnet",
+      "fuji": "Fuji",
+      "testnet": "Testnet",
+      "preview": "Preview",
+      "preprod": "Preprod",
+      "westend": "Westend"
+    },
+    "networkKind": {
+      "testnet": "Testnet",
+      "mainnet": "Mainnet",
+      "mixed": "Mainnet + testnet"
+    },
+    "profile": {
+      "minimal": "Minimal",
+      "pruned": "Pruned",
+      "validator-ready": "Validator-ready",
+      "rpc": "RPC"
+    },
+    "col": {
+      "id": "ID",
+      "chain": "Chain",
+      "network": "Network",
+      "profile": "Profile",
+      "status": "Status",
+      "disk": "Disk"
+    },
+    "cli": {
+      "usage": "Usage: ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|policy|mithril|prune|switch-network|snapshot|compose|settings [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--execute] [--json]"
+    },
+    "clients": {
+      "el": "Execution client",
+      "cl": "Consensus client"
+    },
+    "mithril": {
+      "label": "Restore from Mithril snapshot first (recommended on testnet)",
+      "action": "Restore with Mithril"
+    },
+    "errors": {
+      "notFound": "Validator instance not found",
+      "invalidId": "Invalid instance id",
+      "diskLow": "Not enough free disk for this chain, network, and profile",
+      "diskUnknownMainnet": "Cannot measure free disk; refusing mainnet create",
+      "needDocker": "Docker Compose is required and was not found",
+      "composeFailed": "docker compose failed",
+      "needConfirm": "Clear requires confirm=instance id or CLEAR",
+      "mithrilAdaOnly": "Mithril restore is only available for Cardano",
+      "needMithrilConfirm": "Mithril requires confirm=instance id or MITHRIL",
+      "mithrilBlocked": "Mithril docker run was blocked by the allowlist",
+      "mithrilKey": "Could not load the Mithril genesis verification key",
+      "mithrilFailed": "Mithril snapshot download failed",
+      "pruneFailed": "Prune failed",
+      "switchNeedStop": "Stop the node before switching network",
+      "switchNeedClear": "Switching network clears chain data. Confirm with instance id or CLEAR",
+      "composeMissing": "Compose file not found",
+      "composeNotManaged": "Refusing to write a compose file that is not YSK-managed",
+      "badDataPath": "Data path must be an absolute directory outside system paths",
+      "portInUse": "That RPC port is already used by another validator instance",
+      "snapshotUnsupported": "No allowlisted snapshot source for this chain",
+      "snapshotLookup": "Could not resolve the official snapshot pointer",
+      "needSnapshotConfirm": "Snapshot restore requires confirm=instance id or SNAPSHOT",
+      "snapshotBlocked": "Snapshot docker run was blocked by the allowlist",
+      "snapshotFailed": "Snapshot download or extract failed"
+    },
+    "notes": {
+      "beta": "This feature is Beta. Host changes need root and YSK_EXECUTE=1.",
+      "noKeys": "YSK Server never generates or stores staking keys.",
+      "dockerSoon": "Install and start from this page wizard. Host changes need root and YSK_EXECUTE=1.",
+      "dryCreate": "Wrote instance spec and compose (dry-run). Pass --execute and YSK_EXECUTE=1 to start containers.",
+      "dryStart": "Start is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "dryStop": "Stop is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "dryClear": "Clear is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "created": "Node created and compose started",
+      "started": "Node started",
+      "stopped": "Node stopped",
+      "cleared": "Chain data cleared",
+      "dryMithril": "Mithril restore is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "mithril": "Mithril snapshot restored; node restarted",
+      "dryPrune": "Prune is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "pruned": "Unused project images pruned",
+      "pruneProfile": "Client-native prune is the pruned/minimal profile. Recreate to change it.",
+      "sameNetwork": "Already on that network",
+      "drySwitch": "Network switch is dry-run.",
+      "switched": "Network switched and chain data cleared",
+      "dryCompose": "Would write compose.yml",
+      "composeWrote": "Wrote compose.yml",
+      "statsEmpty": "No running containers to measure",
+      "autoClearNone": "No stopped instance to auto-clear",
+      "drySnapshot": "Snapshot restore is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "snapshotEthEl": "Restored ethPandaOps EL archive and reset CL for checkpoint sync",
+      "snapshotEthCl": "Reset CL data for official checkpoint sync",
+      "snapshotNear": "Wiped NEAR data; compose will re-init official genesis and epoch sync",
+      "nativePrune": "Ran the client-native prune command",
+      "dryDelete": "Delete is dry-run. Pass --execute and YSK_EXECUTE=1.",
+      "deleted": "Node deleted"
+    },
+    "create": "Create node",
+    "wizard": {
+      "title": "Create node",
+      "stepOf": "Step {{n}} / {{total}}",
+      "stepChain": "Chain",
+      "stepNetwork": "Network",
+      "stepProfile": "Profile",
+      "stepSummary": "Summary",
+      "needDocker": "Docker Engine is not installed. Install it first — this button stays disabled.",
+      "diskNeed": "This profile needs about {{need}} · free {{free}}",
+      "diskShort": "Not enough free disk for this chain / network / profile",
+      "back": "Back",
+      "next": "Next",
+      "install": "Install",
+      "mainnetWarn": "Mainnet needs a lot of free disk (ETH often 800 GiB+). Testnet is recommended.",
+      "mainnetAck": "I understand the disk and slashing risk. Continue with mainnet.",
+      "heavyWarn": "This chain is heavy (large disk and high IOPS). Mainnet Solana typically needs 2 TiB+.",
+      "memory": "Memory limit",
+      "cpus": "CPU limit",
+      "dataPath": "Data path",
+      "rpcPort": "RPC port",
+      "limitNone": "No limit",
+      "rpcDefault": "Default",
+      "customPath": "Use a custom data path",
+      "installConfirmTitle": "Install this node?",
+      "installConfirmDesc": "{{chain}} · {{network}} · {{profile}}. About {{disk}} of disk. The image pull can take a long time.",
+      "installC1": "Several gigabytes of images may be downloaded.",
+      "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically."
+    },
+    "actions": {
+      "detail": "Details",
+      "start": "Start",
+      "stop": "Stop",
+      "restart": "Restart",
+      "clear": "Clear",
+      "upgrade": "Upgrade",
+      "clearConfirm": "Type instance id or CLEAR",
+      "prune": "Prune",
+      "switchNetwork": "Switch network",
+      "removeUnit": "Also remove compose / instance record",
+      "restoreAfter": "Restore snapshot after clear",
+      "delete": "Delete",
+      "deleteTitle": "Delete {{id}}",
+      "deleteDesc": "This removes the node from the panel.",
+      "deleteC1": "Docker Compose is stopped and removed",
+      "deleteC2": "Chain data on disk is deleted",
+      "deleteC3": "The instance record is removed",
+      "pruneTitle": "Prune unused images",
+      "pruneDesc": "Type the instance id to prune unused Compose images for this node.",
+      "pruneC1": "Unused images labelled for this Compose project are deleted.",
+      "clearTitle": "Clear {{id}}",
+      "clearC1": "Chain data on disk is deleted.",
+      "clearC2": "The instance stays in the panel, stopped and empty.",
+      "switchTitle": "Switch network",
+      "switchC1": "The node is stopped and chain data is wiped before the new network is written."
+    },
+    "policy": {
+      "label": "Upgrade policy",
+      "manual": "Manual",
+      "notify": "Notify",
+      "auto-safe": "Auto (safe)",
+      "auto-all": "Auto (all)"
+    },
+    "logs": {
+      "empty": "No logs yet",
+      "follow": "Follow logs"
+    },
+    "compose": {
+      "label": "Compose file",
+      "save": "Save compose"
+    },
+    "snapshot": {
+      "action": "Restore snapshot",
+      "mithril": "Cardano uses Mithril for certified snapshot restore.",
+      "eth": "Ethereum mainnet uses official checkpoint sync on the consensus client. EL continues snap sync.",
+      "ethEl": "Hoodi/Sepolia can restore an ethPandaOps EL archive, then checkpoint-sync the CL.",
+      "avax": "Avalanche uses state-sync in the compose profile.",
+      "near": "Official free NEAR tarball snapshots were retired. Restore wipes data and uses official genesis plus epoch sync.",
+      "none": "No snapshot source is configured for this chain."
+    },
+    "stake": {
+      "title": "Prepare for staking (you keep the keys)",
+      "offlineKeys": "Generate keys offline. The panel never stores them.",
+      "deposit": "Complete deposit / registration on the official launchpad.",
+      "withdrawal": "Set withdrawal credentials yourself.",
+      "monitor": "Watch disk, peers, and upgrade badges on this page."
+    },
+    "alerts": {
+      "diskTitle": "Validator disk critical",
+      "diskBody": "Free space on the validator data volume is critically low.",
+      "upgradeTitle": "Validator upgrade available",
+      "upgradeBody": "One or more node clients have a newer pinned version.",
+      "syncTitle": "Validator node needs attention",
+      "syncBody": "A node has been syncing for more than 6 hours or reported an error.",
+      "rollbackTitle": "Validator upgrade rolled back",
+      "rollbackBody": "Upgrade of {{id}} failed the health check and was rolled back."
+    },
+    "upgrade": {
+      "changelog": "Changelog"
+    },
+    "readiness": {
+      "dockerTitle": "Docker for validator nodes",
+      "dockerOk": "{{count}} validator instance(s); Docker is installed",
+      "dockerMissing": "Validator instances exist but the docker binary was not found"
+    },
+    "detail": {
+      "status": "Status",
+      "sync": "Sync",
+      "peers": "Peers",
+      "version": "Version",
+      "access": "Access",
+      "upgrade": "Updates",
+      "upgradeHint": "How this node tracks client versions.",
+      "network": "Network",
+      "networkHint": "Switching network stops the node and clears chain data. Confirm under Clear data first.",
+      "maintain": "Maintenance",
+      "danger": "Clear data",
+      "dangerHint": "Type the instance id or CLEAR. This deletes chain data on disk.",
+      "compose": "Compose",
+      "logs": "Logs"
+    },
+    "state": {
+      "unknown": "Unknown",
+      "stopped": "Stopped",
+      "running": "Running",
+      "syncing": "Syncing",
+      "error": "Error"
+    }
   },
   "vnc": {
     "pageDesc": "VNC server & client",
@@ -11681,15 +13551,19 @@
     },
     "installHint": "TigerVNC → noVNC; XFCE optional",
     "needTigerVnc": "TigerVNC required",
+    "needXfceFirst": "Install XFCE first",
+    "needSessionRunning": "Session is not running — start it first",
     "needNovnc": "noVNC required",
     "needXfce": "XFCE (optional)",
     "needViewer": "Viewer (optional)",
     "needViewerOrNovnc": "Viewer or noVNC",
     "settingsHint": "Defaults for new accounts",
+    "settingsNeedStack": "These defaults apply when TigerVNC (and XFCE if selected) are installed. Install them on the Install tab first.",
+    "clientNeedNovnc": "Open in browser needs noVNC. Install it on the Install tab before adding remotes you expect to open here.",
     "defaultDesktop": "Default desktop",
     "defaultGeometry": "Default resolution",
     "defaultDepth": "Colour depth",
-    "defaultRfbBind": "RFB listen",
+    "defaultRfbBind": "VNC (RFB) listen range",
     "defaultAutostart": "Autostart sessions",
     "autostartLabel": "Start on boot",
     "settingsSaved": "VNC defaults saved",
@@ -11756,12 +13630,16 @@
     "nextPage": "Next",
     "pageOf": "Page {{page}} / {{total}} · {{count}}",
     "deleteAccountTitle": "Delete VNC account?",
-    "deleteAccountDesc": "Remove control-plane account {{name}} ({{user}}). Session will be stopped first.",
-    "deleteAccountC1": "VNC session for this display",
-    "deleteAccountC2": "Panel metadata under dataDir/vnc",
-    "deleteAccountC3User": "Linux user home will be removed (userdel -r)",
-    "deleteAccountC3Keep": "Linux user will be kept on the system",
+    "deleteAccountDesc": "Remove control-plane account “{{name}}” (Linux user {{user}}). The VNC session for this display stops first.",
+    "deleteAccountC1": "The VNC session for this account will be stopped first.",
+    "deleteAccountC2": "The panel VNC account record will be removed.",
+    "deleteAccountC3User": "The Linux user and home directory will also be removed. If the host refuses, the panel reports failure and the user stays.",
+    "deleteAccountC3Keep": "The Linux user stays on the host; only the panel account is removed.",
     "removeLinuxUser": "Also remove Linux user and home directory",
+    "deleteKeepUserWarn": "The Linux user will stay on the host as an orphan. You must clean it up later.",
+    "bindRfbLine": "RFB {{bind}} :{{port}}",
+    "bindNovncLine": "noVNC 127.0.0.1:{{port}}",
+    "bindNovncHint": "noVNC listens on localhost. The desktop is reached through this panel, not the public internet, unless RFB bind is all interfaces.",
     "connection": "Connect",
     "connectionTitle": "Connection materials",
     "connectionDesc": "How clients reach {{name}}",
@@ -11804,7 +13682,8 @@
     "stackMissingShort": "Not installed",
     "editClientTitle": "Edit remote client",
     "editClientDesc": "Update path, hosts, and optional stored password.",
-    "clientUpdated": "Client profile updated"
+    "clientUpdated": "Client profile updated",
+    "rememberNeedPassword": "Enter a password first."
   },
   "vpn": {
     "pageDesc": "VPN server & client",
@@ -11869,6 +13748,11 @@
     "ensureServer": "Apply server",
     "openFirewall": "Open {{port}}/{{proto}}",
     "presets": "Port presets",
+    "portHint": {
+      "51820": "Default WireGuard listen port",
+      "51821": "Alternate WireGuard listen port",
+      "51822": "Second alternate WireGuard listen port"
+    },
     "proto": "Protocol",
     "protoUdp": "UDP",
     "protoTcp": "TCP",
@@ -11878,8 +13762,16 @@
     "peersTitleOvpn": "Client configs",
     "peersTitleSs": "Access keys",
     "peerName": "Name",
-    "peerNamePlaceholder": "phone",
+    "peerNamePlaceholder": "office-laptop",
     "addPeer": "+ Add",
+    "installEngineFirst": "Install the VPN engine first",
+    "needServerRunning": "{{engine}} is not running — apply the server first",
+    "engineSummarySoftware": "{{installed}} installed · {{running}} running",
+    "privateKeyOnce": "The client private key is shown only here. Download or copy it now — it cannot be recovered later.",
+    "showPrivateKey": "Show private key",
+    "hidePrivateKey": "Hide private key",
+    "deletePeerTitle": "Delete peer {{name}}?",
+    "deletePeerDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the config cannot be restored. The WireGuard server stays up.",
     "addPeerWg": "+ Add peer",
     "addPeerOvpn": "+ Add client",
     "addPeerSs": "+ Add key",
@@ -11935,6 +13827,8 @@
       "lanCidrs": "LAN networks",
       "customCidr": "CIDR",
       "addCidr": "Add"
-    }
+    },
+    "engineNotInstalled": "This VPN engine is not installed on the host.",
+    "serverNotListening": "Server unit is not active. UDP/TCP {{port}} may be closed."
   }
 }