ysk-server-shared 1.0.0 → 1.1.0

package/locales/zh-CN/translation.json

@@ -130,7 +130,17 @@
     "labelStderr": "标准错误",
     "labelAckCli": "确认 + CLI JSON",
     "labelStdoutBody": "CLI 标准输出内容",
-    "resultOuterHint": "外层 result 为 CLI --json 标准输出。"
+    "resultOuterHint": "外层 result 为 CLI --json 标准输出。",
+    "statusFlowTitle": "状态流程",
+    "statusFlow": "仅注册→在线→陈旧（>60s）→离线（断开连接）。过滤器“离线”已断开。",
+    "colSession": "会话UUID",
+    "copySession": "复制集群/CLI --session 的会话 UUID",
+    "staleFor": "看不见的{{年龄}}",
+    "commandTitle": "为此会话排队命令",
+    "historyTitleShort": "打开命令历史记录（只读）",
+    "expEdge": "在边缘：",
+    "noteAllowlist": "Agent tool calls must pass the allowlist.",
+    "noteRbacCap": "Agent role is capped at write-low."
   },
   "ai": {
     "status": {
@@ -227,7 +237,7 @@
     "siteSettings": "站点设置",
     "saveApply": "保存并应用",
     "settingsSaved": "已保存",
-    "setGzip": "Gzip",
+    "setGzip": "压缩包",
     "setShowVersion": "显示版本",
     "setHttp2": "HTTP/2",
     "setBody": "Body 上限",
@@ -248,7 +258,11 @@
     "cleanupConflicts": "清理冲突残留",
     "cleanupConflictsTitle": "清理全部冲突残留？",
     "cleanupConflictsDesc": "移除所有与项目或独立站 ServerName 冲突的磁盘 conf。项目行会保留。",
-    "artifactRemovedOk": "已移除残留 conf"
+    "artifactRemovedOk": "已移除残留 conf",
+    "sslTerminatedUpstream": "TLS 在 Nginx 前面结束",
+    "removeArtifactHint": "只删除此残留磁盘 conf，不会删除项目。",
+    "sourceOrphan": "Leftover",
+    "orphanSite": "Project gone"
   },
   "applyStatus": {
     "draft": "草稿",
@@ -285,7 +299,10 @@
       "project.publish": "发布 Nginx",
       "project.suspend": "暂停项目",
       "software.install": "安装软件",
-      "software.update": "更新软件"
+      "software.update": "更新软件",
+      "backup.restore": "Backup restore",
+      "backup.run": "Backup run",
+      "backup.delete": "Backup deleted"
     }
   },
   "backups": {
@@ -419,7 +436,26 @@
     "remotePushSub": "本地 tar 成功后可推送到 SFTP、本机路径或 S3",
     "accessKey": "访问密钥",
     "secretKey": "密钥",
-    "overwriteConfirmHint": "输入 OVERWRITE 确认覆盖"
+    "overwriteConfirmHint": "输入 OVERWRITE 确认覆盖",
+    "testRemote": "测试目的地",
+    "testRemoteDone": "远端探测完成",
+    "testRemoteFailed": "远端探测失败",
+    "resticRepoPh": "面板资料目录／restic 库",
+    "testDisabledHint": "请先开启远端推送才可测试。",
+    "identityId": "出站 SSH 身份",
+    "identityHint": "首选。与 /security SSH 相同的保管库。密码需要sshpass。",
+    "identityNone": "无 — 密码或默认密钥",
+    "remotePathHint": "相对于远程用户的主目录（或 SFTP chroot）。 “。”就是那个家。",
+    "restoreFullTitle": "覆盖此存档中的项目文件和数据库 - 输入文件名进行确认",
+    "restoreWebTitle": "仅从此存档恢复网站文件",
+    "previewTitle": "无需写入即可预览恢复",
+    "partialSkipped": "部分 — 跳过一些项目",
+    "testRemoteHint": "Connects to the remote host and writes a small probe file. Not read-only.",
+    "skippedListHint": "These projects were skipped:",
+    "goLogs": "Open logs",
+    "goAbout": "Backup notes",
+    "skippedPendingOs": "Skipped — OS user / home not provisioned",
+    "latestFile": "Latest archive"
   },
   "btTracker": {
     "title": "BT追踪器",
@@ -461,7 +497,7 @@
     "copy": "複製",
     "copied": "已複製",
     "statsTorrents": "Torrent 数",
-    "statsPeers": "Peers",
+    "statsPeers": "同行",
     "statsAnnounces": "Announce 次数",
     "statsJobs": "进行中任務",
     "openShares": "档案分享",
@@ -526,7 +562,7 @@
     "exposureTitle": "网络存取",
     "protoHttp": "HTTP",
     "protoWs": "WS",
-    "protoUdp": "UDP",
+    "protoUdp": "UDP协议",
     "saveOk": "设定已储存",
     "startedOk": "Tracker 已启動",
     "stoppedOk": "Tracker 已停止",
@@ -538,14 +574,93 @@
     "udpPortClassic": "6969 · 传统",
     "portSuggest8000": "8000 · 建议",
     "saveOkRestart": "已保存 — 重新启动跟踪器以应用端口",
-    "announceHostUnset": "—"
+    "announceHostUnset": "未设置",
+    "tabTrackers": "Tracker",
+    "addTorrent": "加入 Torrent",
+    "addTorrentTitle": "加入 Torrent",
+    "addTorrentHint": "上传 .torrent 或粘贴 magnet，再选保存文件夹。文件不齐会用 WebTorrent 下载，齐了就做种。",
+    "dropTorrent": "將 .torrent 拖放到此處",
+    "chooseFile": "或選擇檔案",
+    "magnetLabel": "磁铁",
+    "magnetPlaceholder": "磁铁:?xt=瓮:btih:…",
+    "inspect": "读取",
+    "extraTrackersPreview": "將額外向 {{n}} 個常用 Tracker announce",
+    "saveLocation": "保存位置",
+    "saveRootPublic": "公开文件",
+    "newFolder": "新文件夹",
+    "destPreview": "将写入",
+    "startDownload": "开始下载",
+    "filterDownloading": "下载中",
+    "filterPaused": "已暂停",
+    "filterError": "错误",
+    "emptyDrop": "將 .torrent 拖放到此處，或選擇檔案",
+    "emptyHint": "下载会写入你指定的文件夹；文件已齐就直接做种。引擎是 WebTorrent，不会另外安装下载软件。",
+    "pause": "暂停",
+    "resume": "继续",
+    "openFolder": "打开文件夹",
+    "remove": "移除",
+    "removeKeep": "移除并保留文件",
+    "removeDelete": "移除并删除文件",
+    "removeConfirm": "要从资料库移除此 Torrent？",
+    "kindShare": "分享",
+    "filesInTorrent": "個檔案",
+    "extraTrackersDesc": "这里是额外 announce。资料库下载／做种和文件 BT 分享都会一并通知这些 Tracker。不会取代 .torrent 原有清单，也不会让本机 Tracker 对外开放。",
+    "extraTrackersEmpty": "还没有常用 Tracker。加入 http(s)／udp／ws(s) announce URL 才可靠外站找 peers。",
+    "extraTrackerAdd": "加入",
+    "extraTrackerUrl": "公布网址",
+    "extraTrackerApply": "套用到现有做种",
+    "extraTrackerApplyOk": "已套用常用 Tracker",
+    "extraEnabled": "启用",
+    "extraTrackerBad": "URL 必须以 http://、https://、udp://、ws:// 或 wss:// 开头",
+    "extraTrackerDup": "清单已有此 URL",
+    "extraTrackerLimit": "最多 32 个常用 Tracker",
+    "addOk": "已加入资料库",
+    "savedTo": "保存",
+    "folderEmpty": "没有子文件夹",
+    "needTorrentFile": "请选择 .torrent 文件",
+    "torrentTooBig": ".torrent 大於 8 MiB",
+    "seedStatusDownloading": "下載中",
+    "seedStatusChecking": "檢查中",
+    "seedStatusPaused": "已暫停",
+    "seedStatusQueued": "排隊中",
+    "swarmLeftover": "Tracker 记录另有 {{count}} 个 announce（不是数据库 Torrent 列；来源不同）",
+    "addSourceSection": "来源",
+    "addSourceFile": "文件",
+    "addSourceMagnet": "磁铁",
+    "previewSection": "预览",
+    "saveRoot": "根目录",
+    "clearFile": "清除文件",
+    "extraTrackersTitle": "额外 announce",
+    "extraTrackersEmptyTitle": "尚未加入 Tracker",
+    "extraEnabledCount": "{{count}} 条已启用",
+    "extraApplyHint": "至少启用一条才可套用到现有做种",
+    "destMode": "此文件夹的用法",
+    "seedExisting": "使用现有文件做种",
+    "downloadNewFolder": "下载到新文件夹",
+    "destFileConflict": "此处已有文件 {{name}}。请另选文件夹；若文件就是此 Torrent 的内容，请选「使用现有文件做种」。",
+    "waitingPeers": "正在等待 peers。若文件已在此主机，请重新加入并选「使用现有文件做种」。",
+    "stopTitle": "停止跟踪器 - 播种和下载将中断",
+    "stopDesc": "正在运行的种子停止通知。对等点会断开连接，直到您再次启动跟踪器。",
+    "fillPublicHost": "使用{{主机}}",
+    "fillPublicHostTitle": "填写当前面板主机名作为公告主机",
+    "listenHostHint": "0.0.0.0 listens on every address. Prefer 127.0.0.1 unless peers must reach this host.",
+    "listenAllWarn": "Tracker is bound to all addresses. With the firewall off this is public. Bind 127.0.0.1 for local-only, or restrict the port in the firewall.",
+    "bindLoopback": "127.0.0.1 only",
+    "bindAll": "0.0.0.0 (all)",
+    "seederPortMin": "Peer port start",
+    "seederPortMax": "Peer port end",
+    "statsLibrary": "Library",
+    "statsLibraryHint": "Torrents in the panel library / file shares",
+    "statsTrackerLeftover": "Tracker leftover",
+    "statsTrackerLeftoverHint": "Tracker announce hashes that are not library rows",
+    "statsAnnouncesHint": "Announce requests seen by the tracker process"
   },
   "catalog": {
     "sw": {
       "vsftpd": "vsftpd（FTPS）",
       "db_util": "db-util（FTP 用户数据库）",
       "nginx": "Nginx",
-      "certbot": "Certbot（Let's Encrypt）",
+      "certbot": "Certbot (Let's Encrypt)",
       "mysql_client": "MySQL／MariaDB 客户端",
       "mysql_server": "MySQL 服务器",
       "mariadb_server": "MariaDB 服务器",
@@ -565,7 +680,7 @@
       "python": "Python",
       "go": "Go",
       "rust": "Rust",
-      "chromium": "Chromium／Chrome"
+      "chromium": "Chromium / Chrome"
     },
     "php": {
       "session": "会话",
@@ -689,7 +804,93 @@
     "deleteNodeDesc": "将删除 CDN 节点「{{name}}」。",
     "deleteSiteDesc": "将删除 CDN 站点「{{name}}」。",
     "deleteSiteC1": "站点策略与边缘关联",
-    "deleteSiteC2": "已下发的 nginx 配置需另行清理或重新应用"
+    "deleteSiteC2": "已下发的 nginx 配置需另行清理或重新应用",
+    "statOnline": "线上",
+    "statOffline": "离线 {{n}}",
+    "statHitRate": "命中率 {{v}}",
+    "hitNoStats": "尚无边缘统计",
+    "loopbackOriginBlocked": "不会把回环 origin {{url}} 写到远端边缘。请先改成可达的 origin。",
+    "applyFailedHint": "套用失败 — 见下方说明",
+    "applyStatus": {
+      "draft": "草稿",
+      "planned": "已计划",
+      "applying": "套用中",
+      "applied": "已套用",
+      "failed": "失败",
+      "partial": "部分"
+    },
+    "drain": "流走",
+    "drainTitle": "停止向此边缘发送新的 CDN 流量",
+    "drainDesc": "排空“{{name}}”？现有连接将保留直至完成。",
+    "drainLastTitle": "这是最后一个边缘——排水将使每个站点都没有边缘",
+    "drainLastDesc": "“{{name}}”是唯一的边缘。将其排干后，所有站点都没有边缘。",
+    "clearDrainTitle": "再次在此边缘接受新流量",
+    "clearDrainDesc": "清理“{{name}}”上的排水管吗？",
+    "deleteNodeTitle": "删除此 CDN 边缘",
+    "deleteLastNodeTitle": "删除最后一条边——所有站点都将没有边",
+    "purge": "清除",
+    "previewTitle": "预览 nginx 配置（不写）",
+    "writeConfTitle": "编写边缘 nginx 配置文件",
+    "applyEdgesTitle": "将此站点应用到边缘（写入 nginx）",
+    "purgeTitle": "清除边缘缓存",
+    "dnsSyncTitle": "写入CDN DNS记录",
+    "probeDnsTitle": "探测边缘和 DNS（只读）",
+    "distSslTitle": "将 TLS 材质复制到边缘",
+    "leIssueTitle": "颁发 Let’s Encrypt 证书并分发",
+    "deleteSiteTitle": "删除此 CDN 站点",
+    "siteOpConfirmGeneric": "对“{{name}}”运行此操作吗？",
+    "siteOpConfirmDesc": "站点“{{name}}”·{{action}}。这可以更改 nginx、DNS 或证书。",
+    "siteOpConfirm": {
+      "apply": "将这个网站应用到边缘？",
+      "render": "为这个站点编写 nginx 配置吗？",
+      "purge": "清除该网站的缓存吗？",
+      "dns-sync": "同步此站点的 DNS 吗？",
+      "dist": "将 TLS 分发到边缘？",
+      "issue": "问题让我们加密并分发？"
+    },
+    "pillNodesSites": "{{n}} 个节点 · {{s}} 个站点",
+    "statHit": "命中率",
+    "hitUnknown": "未知",
+    "lastHealthHint": "最后一次探测 {{at}} · {{ok}}",
+    "lastHealthNever": "尚未探测 — 运行 Probe",
+    "lastHealthFail": "探测失败",
+    "healthLoopNeedSites": "先添加站点",
+    "nodeStatus": {
+      "online": "在线的",
+      "offline": "离线",
+      "draining": "排水",
+      "unknown": "未知"
+    },
+    "statOnlineOf": "线上 {{n}}/{{total}}",
+    "statDraining": "Draining {{n}}",
+    "localTest": "local / test",
+    "colRegion": "Region",
+    "previewOnlyNote": "Preview only — nothing was written to the edges.",
+    "statByRegion": "Region: ",
+    "statByApply": "Apply status: ",
+    "col": {
+      "origin": "Origin",
+      "edges": "Edges",
+      "apply": "Apply",
+      "dns": "DNS",
+      "edgesOnline": "Edges online / applied",
+      "dnsRr": "CDN DNS records"
+    },
+    "mode": {
+      "origin_pull": "Origin pull",
+      "reverse_proxy": "Reverse proxy",
+      "static_edge": "Static edge"
+    },
+    "dnsStrategy": {
+      "multi_a": "Multiple A records",
+      "cname": "CNAME",
+      "geo": "Geo"
+    },
+    "edgesOnlineApplied": "{{online}}/{{total}} online · {{applied}} applied",
+    "hitMiss": "Hits {{hits}} / misses {{misses}}",
+    "cacheBytes": "Cache ≈ {{n}} B",
+    "hitRateUnknown": "No access log with cache status and no cache directory, so hit rate cannot be estimated.",
+    "offlineHint": "Offline — probe failed. Remove the node if it is leftover."
   },
   "cli": {
     "unknownCommand": "未知命令：{{command}}\n执行 `{{cli}} help`",
@@ -705,7 +906,7 @@
     },
     "help": {
       "blurb": "控制平面 CLI — AI agent 请优先用 --json。\n文档：docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json",
-      "main": "{{product}} ({{cli}}) v{{version}}\n\n控制平面 CLI — AI agent 请优先用 --json。\n文件：docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\n用法：\n  {{cli}} <command> [options]\n\n命令：\n  setup                 初始化 dataDir + 管理员\n  update                自我更新检查／套用\n  serve                 HTTP API + Web UI\n  system unit-install   安装 ysk-server.service [--enable]\n  tools                 工具列表；tools run --tool <name> [--dry-run]\n  ask                   自然语言 → AI 计划 [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             应用范本\n  hosting               nginx|dns|db|firewall 辅助\n  dns                   zone|zones（AI 别名 → hosting dns-*）\n  logs                  sources|query|journal|overview\n  host                  overview|metrics（唯读）\n  nginx                 status|list|test|sync\n  ssl                   list|get（憑证）\n  db-cluster            list|get|create|plan（HA 先计划）\n  ssh-key               list|create|import|public|export|install|delete（SSH 身分库）\n  ssh-2fa               list|enroll|confirm|install|pam|retire（SSH 登入 TOTP ≠ 面板 2FA）\n  services              主机服務矩阵（systemctl 探测）\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys（2FA · 撤销工作阶段 · API 金钥）\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register（面板 + 边缘）\n  agent run             外送 fleet 轮询（实验）\n  store                 status|export|import|migrate（json|sqlite|postgres document 后端）\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares（沙箱）\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns（面板对等）\n  health                本机模式快照或 --url http://host:port/health\n  readiness | doctor    生产就绪（诚实）\n  migrate               inventory|host|post|status|resume（整机迁移）\n  version | help\n\n全域：\n  --json                JSON 标准输出（AI）\n  --data-dir PATH\n  --config PATH\n  --help | --version\n\n结束码：0 成功 · 1 错误 · 2 验证 · 3 阻挡 · 4 找不到 · 5 主机错误\n\n安全：\n  危险操作预设 dry-run（只出计划）。\n  传 --execute（别名 --apply）+ 环境变数 YSK_EXECUTE=1 才改主机。\n\n例子：\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run 计划\n  {{cli}} projects list --json\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
+      "main": "{{product}} ({{cli}}) v{{version}}\n\n控制平面 CLI — AI agent 请优先用 --json。\n文件：docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\n用法：\n  {{cli}} <command> [options]\n\n命令：\n  setup                 初始化 dataDir + 管理员\n  update                自我更新检查／套用\n  serve                 HTTP API + Web UI\n  system unit-install   安装 ysk-server.service [--enable]\n  tools                 工具列表；tools run --tool <name> [--dry-run]\n  ask                   自然语言 → AI 计划 [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             应用范本\n  hosting               nginx|dns|db|firewall 辅助\n  dns                   zone|zones（AI 别名 → hosting dns-*）\n  logs                  sources|query|journal|overview\n  host                  overview|metrics（唯读）\n  nginx                 status|list|test|sync\n  ssl                   list|get（憑证）\n  db-cluster            list|get|create|plan（HA 先计划）\n  ssh-key               list|create|import|public|export|install|delete（SSH 身分库）\n  ssh-2fa               list|enroll|confirm|install|pam|retire（SSH 登入 TOTP ≠ 面板 2FA）\n  services              主机服務矩阵（systemctl 探测）\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys（2FA · 撤销工作阶段 · API 金钥）\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register（面板 + 边缘）\n  agent run             外送 fleet 轮询（实验）\n  store                 status|export|import|migrate（json|sqlite|postgres document 后端）\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares（沙箱）\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns（面板对等）\n  health                本机模式快照或 --url http://host:port/health\n  readiness | doctor    生产就绪（诚实）\n  migrate               inventory|host|post|status|resume（整机迁移）\n  validators            list|chains|disk|get (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\n全域：\n  --json                JSON 标准输出（AI）\n  --data-dir PATH\n  --config PATH\n  --help | --version\n\n结束码：0 成功 · 1 错误 · 2 验证 · 3 阻挡 · 4 找不到 · 5 主机错误\n\n安全：\n  危险操作预设 dry-run（只出计划）。\n  传 --execute（别名 --apply）+ 环境变数 YSK_EXECUTE=1 才改主机。\n\n例子：\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run 计划\n  {{cli}} projects list --json\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
     },
     "usage": {
       "tools": {
@@ -1295,7 +1496,7 @@
           "--name": {
             "name": {
               "--domain": {
-                "66e857": "用法： ysk-server projects create --name <name> [--domain d] [--runtime node|php|static|python|go|rust] [--template id]\n"
+                "66e857": "用法： ysk-server projects create --name <name> [--domain d] [--runtime node|php|static|python|go|rust] [--template id] [--create-dns] [--create-mail] [--server-ip A.B.C.D] [--server-ipv6 ADDR]\n"
               }
             }
           }
@@ -1331,7 +1532,7 @@
           "get": {
             "create": {
               "deploy": {
-                "253b48": "用法： ysk-server projects list|get|create|deploy|git-deploy|stop|backup|template|health [options]\n  deploy --id UUID [--entry f] [--port N] [--fpm|--builtin] [--reload]\n  git-deploy --id UUID [--git-url URL] [--branch B] [--no-redeploy]\n"
+                "253b48": "用法： ysk-server projects list|get|create|deploy|git-deploy|stop|backup|template|ftp|health [options]\n  deploy --id UUID [--entry f] [--port N] [--fpm|--builtin] [--reload]\n  git-deploy --id UUID [--git-url URL] [--branch B] [--no-redeploy]\n  ftp --id UUID --password P [--user NAME] [--home app|root]\n"
               }
             }
           }
@@ -1575,7 +1776,7 @@
             },
             "status": {
               "bans": {
-                "a8d96b": "用法： {{CLI_NAME}} defense status|bans|suspects|ban|unban|whitelist|stack-apply|fail2ban|firewall|timeline|presets [--json]\n` +\n          `  bans [--q text] [--source fail2ban|panel|ufw|auto]\n` +\n          `  suspects [--q text]\n` +\n          `  stack-apply [--execute]   # UFW + fail2ban + current preset\n` +\n          `  fail2ban | firewall       # deep probes (honest)\n` +\n          `  timeline [--limit N] [--q text]\n` +\n          `  presets                   # list + activePreset\n"
+                "a8d96b": "用法： {{CLI_NAME}} defense status|bans|suspects|ban|unban|whitelist|stack-apply|fail2ban|firewall|timeline|presets [--json]\n  bans [--q text] [--source fail2ban|panel|ufw|auto]\n  suspects [--q text]\n  stack-apply [--execute]   # UFW + fail2ban + current preset\n  fail2ban | firewall       # deep probes (honest)\n  timeline [--limit N] [--q text]\n  presets                   # list + activePreset\n"
               }
             }
           }
@@ -1741,7 +1942,7 @@
         }
       },
       "x": {
-        "972912": "用法：\n  ysk-server migrate inventory [--data-dir PATH] --json\n  ysk-server migrate host --target root@IP [--identity-file PATH|--identity-id ID|--password PW] --execute [--maintenance] [--force-wipe-target]\n  ysk-server migrate post --job ID --data-dir PATH --execute   # on target\n  ysk-server migrate status [--job ID]\n  ysk-server migrate resume --job ID --execute\n"
+        "972912": "用法：\n  ysk-server migrate inventory [--data-dir PATH] --json\n  ysk-server migrate host --target root@IP [--identity-file PATH|--identity-id ID|--password PW] --execute [--maintenance] [--force-wipe-target]\n  ysk-server migrate post --job ID --data-dir PATH --execute   # 在目标机\n  ysk-server migrate status [--job ID]\n  ysk-server migrate resume --job ID --execute\n  ysk-server migrate orphan-homes [--data-dir PATH] --json\n  ysk-server migrate orphan-homes --path /home/ysk-server-UUID --confirm PATH --execute\n"
       },
       "hostingHelp": "用法：ysk-server hosting <sub>\n  危险操作默认 dry-run；加 --execute（+ YSK_EXECUTE=1）才真正应用\n  nginx | nginx-sync [--execute]\n  redis-provision | postgres-provision | mysql-provision [--execute]\n  dns-zone --zone X --ip A.B.C.D [--ipv6 X:X::X] [--validate] [--reload]\n  dns-zones | powerdns-status | powerdns-install [--install|--execute]\n  powerdns-load --zone X --ip A.B.C.D [--load|--execute]\n  email-apply --domain X [--install|--execute]\n  email-mailbox --domain X --local user [--password P] [--ip A.B.C.D] [--system]\n  ftps-apply --domain X [--install|--execute]\n  runtimes | runtime-install --kind node|php|python|go|rust --version V [--install|--execute]\n  dovecot-passdb --domain X | --all\n  webmail-apply --domain webmail.example.com [--download]\n  public-files --domain files.example.com [--reload]\n  email-bootstrap --domain example.com --ip A.B.C.D [--install|--execute]\n  email-deliverability --domain example.com   # PTR/DNSBL/warmup 诚实报告\n  firewall-apply [--smtp] [--execute]\n",
       "logsQuery": "用法：{{CLI_NAME}} logs query --source <id> [--lines N] [--grep G] [--since 1h] [--priority err]\n  source 例：journal:  journal:nginx.service  file:syslog  project:<uuid>\n  {{CLI_NAME}} logs sources --json\n  {{CLI_NAME}} logs journal [--unit nginx.service] --json\n"
@@ -1910,6 +2111,7 @@
     "noData": "没有数据",
     "input": "输入",
     "pleaseEnter": "请输入 {{value}}",
+    "required": "必填",
     "about": "说明",
     "operation": "操作",
     "delete": "删除",
@@ -1996,7 +2198,13 @@
     "show": "顯示",
     "done": "完成",
     "next": "下一步",
-    "previous": "上一步"
+    "previous": "上一步",
+    "all": "全部",
+    "showPassword": "展示",
+    "hidePassword": "隐藏",
+    "more": "更多的",
+    "redirectedTo": "已转到 {{to}}（原为 {{from}}）",
+    "unavailable": "Not available right now"
   },
   "cron": {
     "presetCdTrue": "cd app + true（测试）",
@@ -2135,7 +2343,36 @@
     "sourceHost": "主机",
     "noHostJobs": "此范围没有 crontab 任务",
     "hostPartial": "无法完整读取所有用户 crontab（需要 root）",
-    "pendingInstall": "待安装到系统（{{count}}）"
+    "pendingInstall": "待安装到系统（{{count}}）",
+    "hourRange": "小时必须介于 0–23。",
+    "minuteRange": "分钟必须介于 0–59。",
+    "hoursCommon": "常用小时",
+    "hoursAll": "全部小时",
+    "invalidExpr": "不是有效的 5 栏 cron 表达式。",
+    "needCommand": "请填写指令。",
+    "needUser": "请选择专案或系统用户。",
+    "hostCounts": "主机行数",
+    "hostCountsVal": "{{ysk}} · 其他 {{other}} · 合计 {{total}}",
+    "hostYskYes": "已有面板行",
+    "hostYskNo": "尚无面板行",
+    "emptyHostCrontab": "用户 {{user}} 尚未有 crontab。",
+    "writtenOnHost": "Written",
+    "registeredJobsChip": "Registered",
+    "registeredVsWritten": "Registered in the panel vs written to host crontab",
+    "installPreviewTitle": "Preview before installing to system crontab",
+    "installPreviewDesc": "This merges the YSK block into the host crontab. Existing non-YSK lines stay.",
+    "installPreviewMerge": "Install writes a YSK Server crontab merge block. It does not replace the whole crontab.",
+    "installPreviewEmpty": "No pending managed jobs — install still refreshes the YSK block.",
+    "editJobTitle": "Edit job",
+    "editJobDesc": "Changes stay in the panel until you install to the system crontab.",
+    "saveJob": "Save (management only)",
+    "panelLines": "Panel lines",
+    "otherLines": "Other lines",
+    "totalLines": "Total",
+    "writtenOnHostHint": "Lines already written to the host crontab",
+    "registeredJobsHint": "Jobs registered in the panel (including pending install)",
+    "pendingInstallCount": "{{n}} pending install",
+    "systemJobBadge": "No project · system user"
   },
   "dashboard": {
     "title": "控制台",
@@ -2193,7 +2430,7 @@
     "criticalCount": " · 严重 {{count}}",
     "warnCount": " · 警告 {{count}}",
     "applyAuditBadge": "套用 audit · ok {{ok}} · warn {{warn}} · bad {{bad}}",
-    "executeBadge": "执行{{状态}}",
+    "executeBadge": "系统变更 {{state}}",
     "executeLabel": "系统变更",
     "go": "前往",
     "open": "打开",
@@ -2224,7 +2461,7 @@
     "runtime": "运行环境",
     "runtimeHint": "决定默认 runtime 版本与部署方式",
     "runtimeVersion": "运行环境版本",
-    "versionHint": "写入项目 runtime_version",
+    "versionHint": "会写入项目的运行环境版本设定",
     "serverIpv4": "服务器 IPv4",
     "serverIpv4Hint": "DNS A／邮件 SPF",
     "serverIpv4Ph": "此主机公网 IPv4",
@@ -2246,7 +2483,26 @@
     "noNotifs": "暂无通知",
     "noNotifsDesc": "系统告警与待办会显示于此",
     "applyAuditTitle": "套用状态审计",
-    "applyAuditDesc": "好的 {{ok}} · 警告 {{warn}} · 不好 {{bad}}"
+    "applyAuditDesc": "好的 {{ok}} · 警告 {{warn}} · 不好 {{bad}}",
+    "barTitle": "{{count}} 条主机提示",
+    "levelCritical": "严重",
+    "levelWarn": "警告",
+    "levelInfo": "信息",
+    "colTitle": "提示",
+    "colDetail": "详情",
+    "colSource": "来源",
+    "notifSearch": "搜索通知",
+    "notifAll": "全部",
+    "notifDismiss": "隐藏",
+    "goFix": "前往处理",
+    "needDomainFirst": "请先填域名",
+    "serviceAria": "{{name}}: {{state}}",
+    "sev": {
+      "ok": "OK",
+      "warn": "Warning",
+      "bad": "Problem"
+    },
+    "publicNo2fa": "This panel listens on all interfaces and your admin account has no 2FA."
   },
   "dataTable": {
     "empty": "没有数据",
@@ -2306,6 +2562,9 @@
     "emptyDbInstallFirst": "请先使用上方横幅一键安装 {{engine}}，再用右上角「创建数据库」",
     "emptyDbCannotProvision": "目前无法在服务器创建数据库",
     "emptyDbCreateHint": "用右上角「创建数据库」新增；创建后请再按「应用」",
+    "emptyDbHostHasRows": "主機已有資料庫，但尚未在控制面登記。",
+    "hostHasUntracked": "主機另有 {{count}} 個未在面板登記的資料庫",
+    "hostInventoryHint": "列表只顯示控制面已登記的資料庫；即時名稱來自 SHOW DATABASES。",
     "userList": "用户列表",
     "userListDesc": "可为数据库授权用户",
     "createUserBtn": "+ 创建用户",
@@ -2320,7 +2579,12 @@
     "expiresAt": "到期",
     "revokeRegistration": "撤销登记",
     "remoteDbHosts": "远程数据库主机",
-    "remoteDbHostsDesc": "登记连接目标（密码不回显）",
+    "remoteDbHostsDesc": "登记连接目标（密码不回显）。未按「测试连接」前，已保存 ≠ 可达。",
+    "remoteTest": "测试连接",
+    "remoteTestDone": "远程主机探测完成",
+    "remoteTestOk": "可达",
+    "remoteTestFail": "不可达",
+    "remoteNotChecked": "未测试",
     "displayName": "显示名称",
     "prodReplicaPlaceholder": "生产从库",
     "remoteHostSaved": "已保存远程主机",
@@ -2404,6 +2668,9 @@
       "registrationDeleted": "已删除登记",
       "nodes": "节点",
       "remoteInstallPlan": "远程安装计划",
+      "fleetSession": "机群 agent session id",
+      "fleetSessionHint": "可选。到 /agents 复制 session UUID。填写后该对等节点走机群（不用 SSH）。留空则 scp。",
+      "fleetSessionPh": "Agents 页的 session UUID",
       "fleetSyncPlan": "Fleet sync 计划",
       "standaloneTitle": "目前：单机",
       "standaloneRepl": "未登记主从／流式。指定 primary/master + replica 后生成 conf 与脚本。",
@@ -2471,7 +2738,34 @@
       "probe": "探测",
       "name": "名称",
       "type": "类型",
-      "status": "状态"
+      "status": {
+        "healthy": "健康",
+        "planned": "计划",
+        "partial": "部分的",
+        "failed": "失败的",
+        "draft": "草稿",
+        "degraded": "降级",
+        "applied": "应用"
+      },
+      "engineNotInstalled": "此主机上未安装 {{engine}} - 请先安装它，或打开实际运行的引擎。",
+      "fleetSessionNone": "无 — 使用 SSH",
+      "fleetSessionOpenAgents": "打开 /agents 注册会话",
+      "createWizardTitle": "打开计划向导。需要本地 IP 和 ≥1 个对等点。仅写入面板工件（试运行）。在您申请之前不要重新启动发动机。",
+      "bootstrap": "引导程序",
+      "fleetApply": "车队申请",
+      "planTitle": "重新生成集群计划（不更改主机）",
+      "writeFileTitle": "在面板数据目录下写入管理文件（试运行）",
+      "probeLocalTitle": "仅探测该主机",
+      "probeAllTitle": "探查每一位注册会员",
+      "bootstrapTitle": "安装本地插件并引导第一个节点",
+      "remoteInstallPlanTitle": "预览远程安装（不执行）",
+      "downloadBundleTitle": "下载对等配置包 (.tar.gz)",
+      "pushPlanTitle": "预览推送到对等点（无 scp）",
+      "fleetSyncPlanTitle": "预览队列同步（不执行）",
+      "fleetApplyTitle": "队列适用于车队成员吗？",
+      "redirectedFromCluster": "You were redirected here from /cluster. This is the database cluster tab.",
+      "roleUnassigned": "No role assigned",
+      "standaloneOtherEngines": "This engine is standalone. Other engines have clusters: {{names}}."
     },
     "console": {
       "dataBrowse": "资料浏览",
@@ -2511,7 +2805,9 @@
       "reloadConfig": "重载设置",
       "disableBoot": "取消自启",
       "needRights": "需要系统变更权限与管理员身分。失败会显示原因，不会假装成功。",
-      "noneFetched": "— 未取得 —"
+      "noneFetched": "— 未取得 —",
+      "disableBootConfirm": "重新启动后引擎将不会启动，直到您再次启用它。",
+      "affectsProjects": "Sites and services that use this engine will be interrupted."
     },
     "expiresLabel": "到期",
     "importEntry": "入口: {{url}}",
@@ -2537,7 +2833,22 @@
     "unfreezeOk": "{{engine}} 修复完成",
     "startAfterUnfreeze": "启动服务（失败时会自动套用修复计划）",
     "serviceDownTitle": "数据库服务未运行",
-    "serviceDownBody": "服务异常。面板会诊断常见原因（冻结、配置残留、空白数据目录、端口冲突等）。数据目录为空：{{empty}}。请按「检查并修复服务」确认执行。"
+    "serviceDownBody": "服务异常。面板会诊断常见原因（冻结、配置残留、空白数据目录、端口冲突等）。数据目录为空：{{empty}}。请按「检查并修复服务」确认执行。",
+    "adoptHostDb": "登记 {{name}}",
+    "registeredVsHostHint": "已在面板登记 / 主机实测",
+    "dumpNeedRegistered": "请先在面板登记数据库",
+    "dumpFirstDbTitle": "导出第一个已登记数据库",
+    "importNeedRegistered": "请先在面板登记数据库",
+    "importLatestNeedConfirm": "需确认 — 会导入到已登记数据库",
+    "adoptHostDbTitle": "只在控制面登记名称，不改主机数据",
+    "cleanupExpiredTempUsersTitle": "清除已过期的面板临时用户",
+    "remoteDeleteTitle": "仅移除登记",
+    "remoteDeleteConfirm": "移除登记 {{name}}？远程服务器不会被改动。",
+    "registeredCount": "Registered",
+    "hostCount": "On host",
+    "registeredUsers": "Registered users",
+    "registeredUsersHint": "Panel registrations only — not every MySQL account",
+    "hostStillExists": "Still on host"
   },
   "dialogs": {
     "confirmDefault": "确认",
@@ -2581,6 +2892,8 @@
     "zonesTitle": "区域 ({{count}})",
     "zonesDesc": "创建区域后可写入／套用 zone",
     "createZone": "+ 创建区域",
+    "mailZonesMissing": "電郵網域尚未建立 DNS 區域：{{domains}}。",
+    "createMailZone": "建立郵件區域",
     "colZoneName": "区域名称",
     "colServerIp": "服务器 IP",
     "colTemplate": "模板",
@@ -2761,7 +3074,270 @@
     "aboutHealthTitle": "服务健康",
     "aboutHealthBody": "在「工具」探测 PowerDNS、修复绑定、开放 53 端口。",
     "aboutStackTitle": "软件版本",
-    "aboutStackBody": "在「软件」检查／更新 PowerDNS 套件。"
+    "aboutStackBody": "在「软件」检查／更新 PowerDNS 套件。",
+    "invalidZone": "区域名称无效。使用真实域名（例如 example.com）。",
+    "invalidIpv4": "IPv4 无效。每个八位位组必须为 0–255。",
+    "createMailZoneNow": "已建立邮件区域 {{domain}}",
+    "healNeedInstall": "PowerDNS 未安装 - 首先将其安装在“软件”选项卡上",
+    "applyNeedService": "DNS 服务未运行 — 在应用之前启动或安装它",
+    "deleteZoneNeedName": "删除此区域 - 您将输入区域名称进行确认",
+    "toolsFirewallTitle": "防火墙（UFW）",
+    "toolsFirewallHint": "允许或拒绝 53 端口。不会启动或停止 PowerDNS。",
+    "toolsUnitTitle": "PowerDNS 服务单元",
+    "toolsUnitHint": "systemd 单元 pdns — 启动、停止、重启、重载。",
+    "installConfirmTitle": "安装 PowerDNS？",
+    "installConfirmDesc": "会安装 pdns-server 并写入受管权威配置。需要 root 与 YSK_EXECUTE=1。",
+    "installConfirmConsequence": "安装并启动后，PowerDNS 会绑定 53 端口。",
+    "installPort53Busy": "53 端口已有程序在监听。未停止或修复该监听前，PowerDNS 可能无法绑定。",
+    "installPort53BusyConsequence": "请先修复绑定或停止其他监听，才可预期 53 端口有响应。",
+    "createZoneNeedValid": "Enter a valid zone name and IPv4 address"
+  },
+  "docker": {
+    "title": "Docker",
+    "subtitle": "在这台服务器安装 Docker Engine，并管理容器、映像、Volume 与验证者 Compose 堆栈。",
+    "refresh": "刷新",
+    "notInstalled": "未安装 Docker Engine。请在此页安装 docker.io 及 docker-compose-v2。",
+    "protected": "受保护",
+    "pruneConfirm": "输入 PRUNE 以确认清理 volume 或系统",
+    "settingsHint": "只开放安全的 daemon.json 选项。应用会写入文件并重启 docker.service。",
+    "cli": {
+      "usage": "用法：ysk-server docker status|ps|images|volumes|networks|df|logs|inspect|exec|start|stop|restart|rm|pull|run|prune|engine|compose [--image IMG] [--name N] [--preset version|help|hostname] [--bin BIN] [--project P] [--execute] [--json]"
+    },
+    "tab": {
+      "overview": "概览",
+      "containers": "容器",
+      "images": "映像",
+      "compose": "Compose",
+      "volumes": "Volume",
+      "networks": "网络",
+      "prune": "清理",
+      "settings": "设置",
+      "about": "说明"
+    },
+    "col": {
+      "engine": "引擎",
+      "containers": "容器",
+      "version": "版本",
+      "dataRoot": "数据目录",
+      "disk": "磁盘",
+      "validators": "验证者堆栈",
+      "name": "名称",
+      "image": "映像",
+      "status": "状态",
+      "ports": "端口",
+      "managed": "由面板管理",
+      "size": "大小",
+      "driver": "驱动",
+      "type": "类型",
+      "reclaimable": "可回收"
+    },
+    "state": {
+      "up": "运行中",
+      "down": "已停止",
+      "running": "Running",
+      "exited": "Exited",
+      "restarting": "Restarting",
+      "restartingCount": "Restarting · {{n}} times",
+      "paused": "Paused",
+      "created": "Created",
+      "dead": "Dead",
+      "removing": "Removing",
+      "unknown": "Unknown"
+    },
+    "actions": {
+      "start": "启动",
+      "stop": "停止",
+      "restart": "重启",
+      "remove": "删除",
+      "logs": "日志",
+      "inspect": "检查",
+      "exec": "执行（version）",
+      "run": "运行映像",
+      "pull": "拉取",
+      "up": "启动",
+      "down": "停止",
+      "createVolume": "创建 volume",
+      "createNetwork": "创建网络",
+      "pruneContainers": "清理容器",
+      "pruneImages": "清理映像",
+      "pruneVolumes": "清理 volume",
+      "pruneSystem": "系统清理",
+      "startEngine": "启动引擎",
+      "stopEngine": "停止引擎",
+      "restartEngine": "重启引擎",
+      "applyDaemon": "应用引擎设置"
+    },
+    "empty": {
+      "containers": "没有容器",
+      "images": "没有映像",
+      "compose": "没有 Compose 项目",
+      "volumes": "没有 volume",
+      "networks": "没有网络",
+      "composeDesc": "Projects come from validator nodes or Compose files already on this host. This page does not accept arbitrary YAML uploads.",
+      "composeCta": "Open validator nodes"
+    },
+    "logs": {
+      "empty": "没有日志",
+      "follow": "Follow"
+    },
+    "settings": {
+      "logMaxSize": "容器日志上限",
+      "liveRestore": "即时还原（引擎重启时保留容器）",
+      "mirrors": "Registry 镜像（每行一个网址）",
+      "insecure": "未加密 Registry（每行一个主机）"
+    },
+    "about": {
+      "body": "Docker 是 YSK Server 的一级主机服务，与 Nginx 同级。由面板用 Ubuntu docker.io + docker-compose-v2 安装。验证者节点以 yskval-* Compose 项目运行。",
+      "honesty": "变更主机需要 root 及 YSK_EXECUTE=1。默认是试运行。此页不是 Kubernetes。",
+      "validators": "打开验证者节点"
+    },
+    "alerts": {
+      "daemonTitle": "Docker 引擎未运行",
+      "daemonBody": "已安装 Docker，但 docker.service 未启动。验证者堆栈无法启动。"
+    },
+    "errors": {
+      "notInstalled": "未安装 Docker",
+      "daemonDown": "Docker 引擎未运行",
+      "needCompose": "需要 docker compose（v2 插件）",
+      "badImage": "映像名称无效",
+      "badName": "名称无效",
+      "badPort": "端口映射无效",
+      "badEnv": "环境变量无效",
+      "badVolume": "磁盘挂载无效",
+      "badNetwork": "网络无效",
+      "protectedNetwork": "不可以删除内建 Docker 网络",
+      "badRestart": "重启策略无效",
+      "badPrune": "清理范围无效",
+      "needPruneConfirm": "清理 volume 或系统需要 confirm=PRUNE",
+      "badDaemon": "引擎设置无效",
+      "composeMissing": "找不到这个项目的 Compose 文件",
+      "logsFailed": "读不到容器日志",
+      "mutateFailed": "Docker 命令失败",
+      "engineFailed": "无法控制 docker.service",
+      "badExec": "exec 只限允许清单内的二进制与预设（不可用 shell，不可开 TTY）",
+      "uninstallBusy": "请先停止由面板管理的容器（包括验证者堆栈）再卸载 Docker"
+    },
+    "notes": {
+      "dryMutate": "此为试运行。要改主机请加 --execute 及 YSK_EXECUTE=1。",
+      "dryPrune": "清理预览（未应用）。",
+      "dryEngine": "引擎控制此为试运行。",
+      "dryDaemon": "将写入 /etc/docker/daemon.json 并重启 docker.service。",
+      "daemonWrote": "已写入 daemon.json",
+      "start": "已启动容器",
+      "stop": "已停止容器",
+      "restart": "已重启容器",
+      "remove": "已删除容器",
+      "ran": "已用映像启动容器",
+      "pulled": "已拉取映像",
+      "exec": "已执行允许清单内的 exec",
+      "imageRemoved": "已删除映像",
+      "volumeCreated": "已创建 volume",
+      "volumeRemoved": "已删除 volume",
+      "networkCreated": "已创建网络",
+      "networkRemoved": "已删除网络",
+      "pruned": "清理完成",
+      "compose": {
+        "up": "已启动 Compose 项目",
+        "down": "已停止 Compose 项目",
+        "restart": "已重启 Compose 项目",
+        "rm": "已删除 Compose 项目"
+      },
+      "engine": {
+        "start": "已启动 docker.service",
+        "stop": "已停止 docker.service",
+        "restart": "已重启 docker.service"
+      }
+    },
+    "needEngineTitle": "请先安装 Docker Engine",
+    "notInstalledValue": "未安装",
+    "nameHint": "字母、数字、下划线、点、连字符（最长 128）",
+    "volPlaceholder": "my-data",
+    "netPlaceholder": "my-net",
+    "runPorts": "发布端口",
+    "runPortsHint": "每行 host:container，例如 8080:80",
+    "runEnv": "环境变量",
+    "runEnvHint": "每行 KEY=value",
+    "runRestart": "重启策略",
+    "runNetwork": "网络",
+    "runVolumes": "Volume",
+    "runVolumesHint": "每行 volume:dest",
+    "runAdvancedHint": "多服务堆栈请用验证者节点，或主机上已有的 Compose 文件。",
+    "daemonConfirmTitle": "应用引擎设置？",
+    "daemonConfirmDesc": "会写入 daemon.json 并重启 docker.service。所有容器都会中断。",
+    "ui": {
+      "whatYouGet": "此页可以做什么",
+      "whatYouGetLead": "先安装 Docker Engine。之后可以运行单个容器、拉取映像，并查看本机已有的验证者 Compose 堆栈。",
+      "capEngine": "引擎",
+      "capEngineDesc": "一键安装 docker.io 及 docker-compose-v2。可在此页启动或停止 docker.service。",
+      "capWork": "容器与映像",
+      "capWorkDesc": "选择常用映像、拉取、运行，然后查看日志或检查容器。",
+      "capStacks": "验证者堆栈",
+      "capStacksDesc": "多服务堆栈是验证者 Compose 项目（yskval-*）。本页不接受上传 YAML。",
+      "cardEngine": "引擎",
+      "cardDisk": "磁盘",
+      "cardWork": "本机现况",
+      "compose": "Compose",
+      "cgroup": "cgroup",
+      "used": "已用",
+      "free": "可用",
+      "running": "运行中",
+      "images": "映像",
+      "volumes": "Volume",
+      "networks": "网络",
+      "goImages": "映像",
+      "goValidators": "验证者节点",
+      "imagePickHint": "请选择常用映像。只有需要其他参考名称时，才选「其他」。",
+      "imageCustom": "其他",
+      "driver": "驱动",
+      "driverLocalOnly": "本页只创建 local volume。",
+      "netDefaultDriver": "新建网络使用 Docker 默认的 bridge 驱动。",
+      "pruneWhat": "要清理什么",
+      "pruneAck": "我明白未使用的数据会被删除，并且无法还原",
+      "pruneAckDesc": "清理 volume 或整个系统无法还原。会按所选范围删除已停止的容器与未使用的映像。",
+      "pruneNow": "立即清理",
+      "useMirrors": "使用 Registry 源",
+      "useInsecure": "允许未加密 Registry",
+      "publishPorts": "向主机发布端口",
+      "attachVolume": "挂载 volume",
+      "setEnv": "设置环境变量",
+      "defaultNet": "默认",
+      "mountPath": "挂载路径",
+      "restartNo": "从不",
+      "restartUnless": "除非已停止",
+      "restartAlways": "始终",
+      "restartOnFail": "失败时",
+      "needAck": "清理前请先确认",
+      "scopeContainers": "已停止的容器",
+      "scopeImages": "未使用的映像",
+      "scopeVolumes": "未使用的 volume",
+      "scopeBuilder": "构建缓存",
+      "scopeSystem": "所有未使用项",
+      "noVolumesYet": "尚无 volume — 请先到 Volume 分页创建。",
+      "customPort": "其他主机端口",
+      "customPortHost": "主机端口",
+      "customPortContainer": "容器端口",
+      "pctUsed": "已用 {{n}}%",
+      "customPortHint": "1–65535。例如 9090 → 80。",
+      "pickBridge": "选择 bridge 网络"
+    },
+    "deleteTitle": "删除 {{id}}",
+    "deleteDesc": "此操作无法复原。",
+    "deleteC1": "会从这台主机移除该资源。",
+    "deleteComposeVal": "这是验证者堆栈 — 验证者实例会一并删除。",
+    "pruneTitle": "清理 Docker 资源",
+    "pruneDesc": "输入 PRUNE 以确认。已删除的数据无法复原。",
+    "pruneC1": "会删除所选范围内未使用的资源。",
+    "pruneC2": "Volume 与系统清理会永久删除未使用的数据卷。",
+    "pruneC3": "会移除此范围内已停止的容器或未使用映像。",
+    "df": {
+      "images": "Images",
+      "containers": "Containers",
+      "volumes": "Local volumes",
+      "builder": "Build cache",
+      "other": "Other"
+    },
+    "deleteRunningWarn": "This container is still running or restarting. It will be force-removed.",
+    "stopEngineDesc": "This stops the Docker engine and all {{n}} container(s) on this host."
   },
   "email": {
     "title": "邮件",
@@ -2812,7 +3388,7 @@
     "needExecute": "需 YSK_EXECUTE",
     "viewQueue": "查看伫列",
     "flushQueue": "清空伫列",
-    "queueHint": "按“查看伫列”读取本机 Postfix 伫列。无 EXECUTE 或无 postqueue 时会显示失败原因。",
+    "queueHint": "本机 Postfix 队列。查看是读取探测；清空需要 YSK_EXECUTE。",
     "deleteThisId": "删除此 ID",
     "queueEmpty": "无待送邮件",
     "queueEmptyHint": "目前没有待送邮件",
@@ -2866,10 +3442,11 @@
     "normal": "正常",
     "statMailboxes": "邮箱",
     "statDnsRecords": "DNS 纪录",
-    "dnsTodosTitle": "DNS",
+    "dnsTodosTitle": "域名系统",
     "copyAllRecords": "复制全部纪录",
     "openDnsPage": "开启 DNS 页",
     "healthScore": "健康分",
+    "healthUnchecked": "尚未檢查",
     "suggestedRecords": "建议纪录数",
     "externalTodosCount": "外部待办",
     "colType": "类型",
@@ -3081,7 +3658,8 @@
       "dmarcMissing": "缺少 DMARC — 强烈建议设置",
       "ptrBad": "PTR 反向 DNS 缺失或不正确 — 请向 VPS 供应商申请",
       "port25Blocked": "外发 Port 25 似乎被封锁 — 请申请解封或改用 SMTP 中继",
-      "port25Unknown": "Port 25 状态未知 — 请执行连通性检查"
+      "port25Unknown": "Port 25 状态未知 — 请执行连通性检查",
+      "dmarcUnpublished": "DMARC 記錄已在面板產生，但公網尚未解析到"
     },
     "stack": {
       "tlsNote": "SMTP／IMAP 用 Let’s Encrypt TLS 证书",
@@ -3122,7 +3700,8 @@
       "postfixReloaded": "已重新加载 Postfix。",
       "postfixReloadFailed": "Postfix 重新加载失败：{{detail}}",
       "dovecotApplied": "已写入 Dovecot TLS 片段并尝试重新加载。",
-      "dovecotSkipped": "已跳过 Dovecot（未安装或 doveconf 不可用）。"
+      "dovecotSkipped": "已跳过 Dovecot（未安装或 doveconf 不可用）。",
+      "dovecotSslOmitted": "邮件证书不存在，已改写 Dovecot 为 ssl=no，避免单元因缺少证书而无法启动。"
     },
     "policyApplySystemHint": "勾选「套用到系统」才会写入 Postfix／Rspamd 映射并重新加载；否则只写控制面草稿。",
     "rateLimitAppliedNote": "已套用每小时外发限额与反垃圾标记（若启用系统套用）。",
@@ -3161,12 +3740,12 @@
     "deliverabilityDesc": "PTR／DNS／端口 25 检查",
     "dnsTodosDesc": "建议纪录可复制到外部 DNS 或到 DNS 页建 zone（写入 ≠ 权威上线）",
     "deliverabilityHonesty": "无法代设 PTR 或解除端口 25 封锁",
-    "warmupSuggest": "暖身建议",
-    "writeSsoSkeleton": "写入 Roundcube SSO 结构",
-    "rateLimitPerHour": "输出消息顶部",
-    "rateLimitGlobalHint": "全域享有各域名",
+    "warmupSuggest": "预热建议",
+    "writeSsoSkeleton": "写入 Roundcube SSO 骨架",
+    "rateLimitPerHour": "每小时讯息上限",
+    "rateLimitGlobalHint": "全域取各域名最小值",
     "savePolicyWritten": "只写入控制面",
-    "dnsblMultiIp": "多IP RBL",
+    "dnsblMultiIp": "多 IP RBL",
     "webmailTool": "网页邮件软件",
     "webmailToolRoundcube": "Roundcube（默认）",
     "webmailToolSnappy": "SnappyMail（轻量）",
@@ -3238,7 +3817,40 @@
     "mailboxEmptyTitle": "尚无邮箱",
     "passwordMismatch": "两次密码不一致",
     "passwordTooShort": "密码至少 8 个字符",
-    "mailboxUpdateNeedField": "请设置新密码或更改状态"
+    "mailboxUpdateNeedField": "请设置新密码或更改状态",
+    "catchallHint": "未对应的本地部分会送到目标信箱。只写草稿，须套用邮件才生效。",
+    "queueSearchPh": "搜索 ID、发件人或收件人…",
+    "queueId": "队列 ID",
+    "queueSender": "发件人",
+    "queueRecipients": "收件人",
+    "queueSize": "大小",
+    "queueReason": "原因",
+    "queueActive": "传送中",
+    "queueHeld": "已暂停",
+    "queueDeferred": "延迟",
+    "deleteQueueTitle": "删除此队列邮件？",
+    "deleteQueueDesc": "从本机 MTA 队列移除 {{id}}。需要 YSK_EXECUTE。",
+    "openQueuePage": "打开邮件队列",
+    "dovecotFailedHint": "Dovecot 服务失败。请先到软件分页查看状态；若邮件证书尚未签发，请先到 SSL 签发 mail 主机名。",
+    "domainsListDesc": "在此主机上注册的邮件域",
+    "healthChecklist": "检查清单 {{score}}/100",
+    "healthChecklistHint": "检查清单分数 — 尚未做 DNS／PTR／25 端口实测",
+    "healthLiveHint": "实测分数",
+    "installWebmailTitle": "创建共享网络邮件项目（首次安装）",
+    "reinstallWebmailTitle": "重建/升级现有的Webmail项目",
+    "reinstallNeedInstall": "首先安装网络邮件",
+    "dovecotFailedStatus": "鸽舍是{{status}}。打开设备摘要的“软件”选项卡。",
+    "mailCertMissing": "{{hosts}} 没有证书。在 SSL 页面上发布。",
+    "mailCertPresent": "邮件证书已颁发 - 这不是缺少证书的问题。",
+    "webmailNeedCert": "{{host}} 没有证书 — 在强制使用 HTTPS 之前在 SSL 上颁发证书。",
+    "flushQueueEmpty": "队列为空",
+    "flushQueueNeedExecute": "刷新队列需要YSK_EXECUTE（主机执行权限）",
+    "healthUncheckedHint": "尚未实测 DNS／PTR／25 端口。",
+    "deliverabilityScore": "送达能力检查包",
+    "opendkimNoReload": "OpenDKIM 不支持重载 — 更改密钥或对照表后请用重启。",
+    "opendkimNoReloadTitle": "此堆栈不支持 systemctl reload opendkim",
+    "tlsRequestLeFor": "Request LE for {{host}}",
+    "deliverabilityChecks": "Checks"
   },
   "errors": {
     "YSK_UNAUTHORIZED": "未授权",
@@ -3279,7 +3891,9 @@
       "sessionExpired": "登录已失效，请重新登录",
       "sessionIdle": "闲置超时，请重新登录",
       "totpNotEnabled": "未启用 2FA",
-      "totpSecretNoDataDir": "TOTP secret 已加密但未设置 dataDir"
+      "totpSecretNoDataDir": "TOTP secret 已加密但未设置 dataDir",
+      "mustChangePassword": "请先设定新密码才可继续",
+      "policyNeedsOwn2fa": "为此账户启用 2FA 并使用 TOTP 代码进行确认，然后再要求其他账户使用 2FA"
     },
     "http": {
       "notFoundRoute": "找不到：{{method}} {{path}}",
@@ -3289,7 +3903,8 @@
       "unprocessable": "操作无法完成（服务器拒绝）",
       "requestFailed": "请求失败（{{status}}）",
       "jsonInvalid": "JSON 无效",
-      "internal": "内部错误"
+      "internal": "内部错误",
+      "payloadTooLarge": "请求内容过大"
     },
     "YSK_HOST_BROWSE_SSRF": "主機瀏覽已被安全政策攔截",
     "YSK_HOST_BROWSE_SESSION": "主機瀏覽工作階段不存在或已過期",
@@ -3306,10 +3921,10 @@
     "startService": "启动服务",
     "notInstalled": "fail2ban 尚未安装",
     "toolHintPrefix": "底层工具：",
-    "toolHintBody": "fail2ban = 扫 log 后",
-    "toolHintTemp": "临时",
-    "toolHintBody2": "ban · 攻击应变请用",
-    "toolHintUfw": "UFW = 端口／永久规则",
+    "toolHintBody": "fail2ban 会扫描日志后临时封锁。攻击应变请用",
+    "toolHintTemp": "",
+    "toolHintBody2": "",
+    "toolHintUfw": "负责端口与永久规则。",
     "tabs": {
       "bans": "封锁列表",
       "whitelist": "白名单",
@@ -3338,7 +3953,7 @@
     "addWhitelist": "加入白名单",
     "applyPolicyIgnoreip": "套用策略（含 ignoreip）",
     "applyIgnoreipOk": "已把 ignoreip 写入 jail.local 并套用",
-    "ignoreipHint": "无 YSK_EXECUTE 时只写管理文件（apply_status=written）；",
+    "ignoreipHint": "没有系统变更权限时只写面板档。套用策略会重建 jail.local 的 ignoreip 并重新载入。",
     "whitelistTitle": "白名单 ({{count}})",
     "whitelistRemoved": "已移除白名单",
     "remove": "移除",
@@ -3376,7 +3991,32 @@
       "reload": "已重新加载 fail2ban",
       "restart": "已重启 fail2ban",
       "stop": "已停止 fail2ban"
-    }
+    },
+    "statWhitelist": "白名单",
+    "invalidIp": "请输入有效的 IPv4、IPv6 或 CIDR。",
+    "whitelistPendingApply": "已写入面板名单。请按「套用策略」才会写入 jail.local。",
+    "ignoreipFile": "dataDir/fail2ban/ignoreip.txt",
+    "jailsTabHint": "显示作用中 Jail 状态。要开关 Jail 请到「策略」分页。",
+    "colJail": "监狱",
+    "colEnabled": "开启",
+    "serviceStateLine": "单元 {{unit}} · {{state}} · 开机 {{boot}}",
+    "jail": {
+      "sshd": "远程登录暴力破解",
+      "nginxHttpAuth": "Nginx HTTP 验证",
+      "nginxBotsearch": "Nginx 扫描／机器人探测",
+      "nginxBadbots": "Nginx 已知恶意机器人",
+      "nginxLimitReq": "Nginx 限速 Jail",
+      "postfix": "Postfix 邮件暴力破解",
+      "dovecot": "Dovecot 邮件登录",
+      "recidive": "累犯"
+    },
+    "cannotBanSelf": "这是主机或您的登录 IP — 将其添加到ignoreip而不是禁止",
+    "suggestIgnoreHint": "建议的管理 IP（仅在您应用策略之前为面板文件）：",
+    "suggestIgnoreAdd": "添加 {{ip}}",
+    "whitelistEmptyWarn": "白名单为空，jail 可能把你自己封锁。套用 ignoreip 前请先加入登录 IP。",
+    "suggestIgnoreLogin": "你的登录 IP {{ip}}",
+    "applyIgnoreEmptyWarn": "白名单为空时套用会清空 ignoreip",
+    "applyIgnoreNeedConfirm": "会重写 jail ignoreip 并重新载入 fail2ban"
   },
   "featurePage": {
     "back": "返回"
@@ -3676,7 +4316,7 @@
     "shareBtStats": "BitTorrent 状态",
     "btSeeds": "种子",
     "btLeechers": "下载者",
-    "btPeers": "Peers",
+    "btPeers": "同行",
     "btUploadSpeed": "上传速度",
     "btDownloadSpeed": "下载速度",
     "btUploaded": "已上传",
@@ -3691,7 +4331,7 @@
     "btError": "做种错误",
     "publicShareMethod": "请选择下载方式",
     "publicShareDirect": "直接下载",
-    "publicShareBt": "BitTorrent",
+    "publicShareBt": "BT",
     "openBtTracker": "打开 BT Tracker",
     "publicShareBtInBrowser": "在浏览器以 WebTorrent 下载",
     "publicShareBtProgress": "已下载 {{pct}}% · {{peers}} 个 peers · ↓ {{down}} · ↑ {{up}}",
@@ -3699,7 +4339,49 @@
     "publicShareBtFailed": "WebTorrent 失败：{{detail}}",
     "publicShareBtNeedMagnet": "此分享没有 magnet 链接",
     "publicShareBtUnsupported": "此浏览器无法运行 WebTorrent；请改用 magnet 或 .torrent",
-    "btNone": "—"
+    "btNone": "—",
+    "uploadStatusSkipped": "已跳过",
+    "uploadStatusCancelled": "已取消",
+    "conflict": {
+      "titleFile": "已有名为“{{name}}”的项目",
+      "titleFolder": "已有名为“{{name}}”的文件夹",
+      "descFile": "请选择处理方式。在选择“替换”之前不会覆盖现有文件。",
+      "descFolder": "请选择处理方式。“合并”会保留现有文件夹，再处理其中的文件。",
+      "incoming": "即将加入",
+      "existing": "已在此处",
+      "kindFile": "文件",
+      "kindFolder": "文件夹",
+      "skip": "跳过",
+      "skipHint": "不加入此项目",
+      "keepBoth": "保留两者",
+      "keepBothHint": "将新项目存为 {{name}}",
+      "replace": "替换",
+      "replaceHint": "覆盖现有文件。可能时会保留版本快照。",
+      "replaceFolderHint": "覆盖文件夹中的同名文件，其余文件会保留。",
+      "merge": "合并",
+      "mergeHint": "保留现有文件夹，并将新文件加入其中",
+      "applyAll": "应用到其余所有重名",
+      "applyAllHint": "本次拖放或复制／移动的其余项目都使用同一做法",
+      "cancelRest": "取消其余项目",
+      "progress": "第 {{current}}／{{total}} 项",
+      "typeMismatch": "此处已有名为“{{name}}”的{{destKind}}，即将加入的是{{incomingKind}}。",
+      "skipped": "已跳过",
+      "cancelled": "已取消"
+    },
+    "emptyTrashTitle": "清空垃圾箱？",
+    "emptyTrashDesc": "垃圾箱中的每个文件都将被永久删除。此操作无法撤消。",
+    "purgeForeverDesc": "该文件将被永久删除。此操作无法撤消。",
+    "webdavReissueUnchanged": "重新签发后令牌编号未变——写入可能未生效，请再试一次。",
+    "webdavDisableFailed": "停用后状态仍为启用——写入可能未生效，请再试一次。",
+    "dirNamedLikeFile": "（文件夹残留；名称像文件）",
+    "webdavAfterEnable": "启用 WebDAV 并签发令牌后才可用。",
+    "webdavAlreadyOff": "WebDAV is already off",
+    "deleteMore": " and {{n}} more",
+    "unshareTitle": "Revoke this share?",
+    "unshareDesc": "Revoke the link for {{name}} ({{url}}). The link stops working immediately.",
+    "pillTrash": "{{count}} in trash",
+    "pillSpace": "{{used}} used",
+    "webdavTokenInactive": "Disabled — token #{{id}} is not active"
   },
   "firewall": {
     "profiles": {
@@ -3732,7 +4414,7 @@
     "notInstalled": "UFW 尚未安装",
     "toolHintPrefix": "底层工具：",
     "toolHintBody": "UFW = 端口／永久规则 · 攻击应变与自动 ban 请用",
-    "toolHintFail2ban": "fail2ban = 日志临时 ban",
+    "toolHintfail2ban": "fail2ban = 日志临时 ban",
     "executeOffHint": "系统变更未开 — 可看状态，改规则需 root + YSK_EXECUTE=1",
     "tabs": {
       "rules": "规则表",
@@ -3792,6 +4474,7 @@
     "deleteRuleDesc": "将从 UFW 移除该规则编号（需系统变更权限）。",
     "servicesTitle": "托管服务端口",
     "servicesHint": "YSK 托管服务的期望网络暴露。启动服务时会自动同步这些规则。",
+    "servicesUfwOff": "UFW 已關閉。此列表只是預期暴露，並非主機上已強制執行的規則。",
     "servicesEmpty": "尚无服务暴露数据",
     "servicesEmptyDesc": "启动托管服务（Web、FTPS、VPN、数据库…）后会出现在此列表。",
     "servicesManualHint": "手动开端口 chips 在「端口」分页 — 建议在此管理，规则会带 ysk-svc 标记。",
@@ -3801,7 +4484,15 @@
     "colPorts": "端口",
     "colSync": "状态",
     "synced": "已同步",
-    "syncNow": "立即同步"
+    "syncNow": "立即同步",
+    "disableConfirmTitle": "停用 UFW？",
+    "disableConfirmDesc": "主机防火墙将停止过滤流量。若主机在公众网络上，SSH 与面板可能直接暴露。",
+    "disableConfirmConsequence": "现有允许／拒绝规则仍会保留，但要重新启用 UFW 才会生效。",
+    "toolHintFail2ban": "fail2ban = 基于日志的临时禁令",
+    "desiredOnlyUfwOff": "设定：{{mode}} · UFW 关闭（未套用）",
+    "syncNotApplied": "UFW 关闭 · 未套用",
+    "defaultNotApplied": "不适用（UFW 关闭）",
+    "ufwOffHint": "UFW 关闭时不应用默认传入"
   },
   "ftp": {
     "title": "FTPS 账户",
@@ -3936,7 +4627,22 @@
     "sftpRegister": "登记公钥",
     "sftpAddedAt": "添加于 {{time}}",
     "sftpTechSummary": "技术细节（高级）",
-    "sftpTechNote": "公钥会写入管理路径"
+    "sftpTechNote": "公钥会写入管理路径",
+    "filterProject": "只显示此项目的 FTP 帐户",
+    "clearProjectFilter": "显示全部帐户",
+    "vsftpdFailedHint": "vsftpd 服务失败。请到服务分页查看设定与日志（listen 与 listen_ipv6 不可同时为 YES）。",
+    "tabService": "服务",
+    "listenConflictLive": "Live vsftpd.conf 有listen={{v4}} 和listen_ipv6={{v6}} — 两个YES 都将无法启动。",
+    "listenConflictNeedFix": "首先修复listen/listen_ipv6（它们不能同时为YES），然后应用。",
+    "fixListenIpv4": "仅使用 IPv4（listen=YES，listen_ipv6=NO）",
+    "liveFileValue": "立即归档：{{value}}",
+    "startBlockedFailed": "服务失败 - 在启动前应用有效的配置",
+    "ftpsNeedCert": "首先选择一个证书域",
+    "detectPublicIp": "检测公网IP",
+    "detectPublicIpTitle": "填写来自该主机的第一个非环回 IPv4",
+    "pasvIpRequired": "套用前请填写 PASV 公网 IP（NAT／云主机）。可探测或手动输入。",
+    "vsftpdFailedGeneric": "vsftpd failed. Open the Service tab for live settings and journal.",
+    "stateFailed": "Failed to start"
   },
   "geo": {
     "continents": {
@@ -4173,6 +4879,8 @@
     },
     "home": "主頁",
     "bookmark": "書籤",
+    "bookmarkAdd": "加入或移除書籤",
+    "bookmarkList": "書籤清單",
     "bookmarks": "書籤",
     "history": "瀏覽記錄",
     "bookmarkToggled": "已更新書籤",
@@ -4215,7 +4923,25 @@
     "mediaAudioLabel": "音频",
     "mediaAudioDesc": "可选自主机 Chrome 的桥接；可能需要解锁点击。",
     "mediaPolicyLabel": "策略",
-    "mediaPolicyDesc": "下载与自动播放遵循上方安全与下载设置。"
+    "mediaPolicyDesc": "下载与自动播放遵循上方安全与下载设置。",
+    "frameBlocked": "页面无法在面板框架内显示。",
+    "historyEmpty": "此工作阶段尚无浏览记录。",
+    "bookmarksEmpty": "尚未有书签。",
+    "closeSessionHint": "会清掉此浏览工作阶段的 Cookie；书签会保留。",
+    "envUnset": "未设置",
+    "envPanelValue": "面板：{{value}}",
+    "settingsNoSandboxWarn": "会关闭 Chromium 沙箱。只应在可信的 container 内使用。下次真实浏览器工作阶段才生效。",
+    "settingsDangerDlWarn": "允许经主机浏览器下载可执行文件与脚本。请确认确实需要。",
+    "settingsDangerConfirmTitle": "启用高风险浏览设置？",
+    "needUrl": "请先在上方输入网址开始会话。",
+    "envColVar": "变量",
+    "envColHost": "主机进程",
+    "envColPanel": "面板设置",
+    "envColEffective": "生效值",
+    "engineBrowserNeedChrome": "Real browser (Chrome not installed)",
+    "egressHint": "The target site sees this server’s outbound address ({{host}}), not your laptop. Cookies stay in the server session jar.",
+    "closeNoSession": "No session yet",
+    "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}"
   },
   "listToolbar": {
     "searchPlaceholder": "搜索…",
@@ -4227,7 +4953,8 @@
     "activeFilters": "已应用 {{count}} 个筛选",
     "noResults": "无匹配结果",
     "noResultsHint": "试试其他关键词，或清除筛选。",
-    "searching": "搜索中…"
+    "searching": "搜索中…",
+    "emptyChip": "No items in this filter"
   },
   "logViewer": {
     "banIpTitle": "到防护中心 ban {{ip}}"
@@ -4244,7 +4971,12 @@
     "totpLabel": "双重验证码",
     "totpHint": "Authenticator 应用中的 6 位数字",
     "submitting": "登录中…",
-    "sessionExpired": "登录已失效，请重新登录"
+    "sessionExpired": "登录已失效，请重新登录",
+    "newPassword": "新密码",
+    "newPasswordAgain": "再次输入新密码",
+    "changePassword": "更改密码",
+    "passwordMismatch": "两次输入的密码不一致",
+    "passwordChanged": "密码已更新"
   },
   "logs": {
     "catSystem": "系统文件",
@@ -4356,8 +5088,8 @@
     "lines": "{{n}} 行",
     "followingSseDyn": " · 跟随中{{sse}}",
     "ipBan": "IP → 封禁",
-    "vacuumNote": "释放 systemd-journal 磁盘。无 EXECUTE 会 blocked，不假成功。",
-    "vacuumTime": "Vacuum 时间",
+    "vacuumNote": "释放 systemd-journald 占用的磁盘。没有系统变更权限时会封锁，不会假装成功。",
+    "vacuumTime": "依保留时间清理",
     "vacuumHint": "建议保留 ≥7 日；操作后重新探测磁盘用量。",
     "logrotateStatus": "系统 logrotate 状态（只读探测）",
     "logrotateMissing": "无 status 档或不可读 — 可于服务矩阵检查 logrotate 套件",
@@ -4365,13 +5097,13 @@
     "relatedOpsDesc": "日志观测 vs 攻击应变分工",
     "scLogsLine": "观测 journal／文件／项目",
     "scProtLine": "攻击应变、自动 ban（点 IP）",
-    "journalVacuumTitle": "Journal 清理（vacuum）",
+    "journalVacuumTitle": "清理 journald 磁盘",
     "journalSection": "杂志",
-    "sseLabel": "上证所",
-    "logrotateLabel": "logrotate",
+    "sseLabel": "SSE",
+    "logrotateLabel": "对数旋转",
     "srcNginx": "nginx",
     "srcSsh": "ssh",
-    "srcFail2ban": "fail2ban",
+    "srcfail2ban": "fail2ban",
     "srcAuthLog": "验证日志",
     "srcNginxError": "nginx 错误",
     "srcLetsEncrypt": "让我们加密",
@@ -4379,7 +5111,36 @@
     "groupVarLog": "/var/log",
     "prioErr": "错误+",
     "prioWarn": "警告+",
-    "prioInfo": "信息+"
+    "prioInfo": "信息+",
+    "srcFail2ban": "fail2ban",
+    "vacuumSize": "限制至 500 MB",
+    "logrotateNoStatus": "尚未有 logrotate 状态档（从未跑过时属常见）。",
+    "autoVacuumOff": "自动清理未启用。启用前时间设定不会执行。",
+    "aboutAllowlist": "探索只可读允许清单内的 journal 单元与 /var/log 路径，不会提供任意主机路径。",
+    "aboutCustomPath": "请在「设置」加入自定义路径（仅限 /var/log 或 /run/log），再到「探索」开启。",
+    "noRowsInWindow": "该时间窗口内没有记录",
+    "showInactiveUnits": "显示非活动单位",
+    "sseNeedFollow": "先开启关注——SSE仅用于实时尾随",
+    "vacuumNeedRetention": "请先填写保留时间（例如 14d）",
+    "vacuumNeedConfirm": "需确认 — 会删除旧 journal 日志",
+    "vacuumSizeNeedConfirm": "需确认 — 会限制 journal 磁盘用量",
+    "vacuumSizeAlreadyBelow": "目前用量已低于上限，此操作通常无动作",
+    "vacuumSizeNoopDesc": "journal 已低于 500 MB。仍会执行 vacuum --size=500M，通常不会删除任何内容。",
+    "journalDiskHint": "目前 systemd-journald 用量（作用中 journal）。不含 /var/log 下的轮替档。",
+    "varLogDiskHint": "/var/log 的估算用量（含轮替档）。",
+    "queryFirst": "请先查询",
+    "projectSourcesTitle": "{{n}} 个来源（文件 + journal）",
+    "logrotatePath": "小路",
+    "logrotateLast": "上次旋转",
+    "logrotateExpand": "显示另外 {{n}} 个",
+    "logrotateCollapse": "显示更少",
+    "logrotateVersion": "状态版本 {{v}}",
+    "errorsWindowHint": "Recent errors from the last overview probe (not live-updating when you switch tabs)",
+    "sourceCount": "{{shown}} shown",
+    "sourceUnavailable": "This source has not produced a log yet",
+    "sourceNoLog": "No log yet",
+    "exportJsonl": "JSONL export",
+    "sseLive": " (live stream)"
   },
   "metrics": {
     "alert": {
@@ -4511,7 +5272,42 @@
     "usageNoteFull": "用量来自本机 du（非估算）。配额为控制面 soft limit；硬 setquota 需「套用限制到系统」。",
     "sseNeedLogin": "未登录，无法开启 SSE",
     "sseSessionExpired": "未登录或 session 失效，无法开启 SSE",
-    "sseHttpError": "流 HTTP {{status}}"
+    "sseHttpError": "流 HTTP {{status}}",
+    "colFilesystem": "文件系统",
+    "colMount": "挂载点",
+    "colSize": "容量",
+    "colUsed": "已用",
+    "colAvail": "可用",
+    "colUsePct": "使用率",
+    "colHome": "主目录",
+    "usageNoteLink": "配额是控制面软上限。要套用硬限制请到专案「隔离」分页。",
+    "alertsBuiltinOnly": "仅内置 CPU/内存/磁盘阈值。没有电子邮件、网络钩子或 Slack 通道。",
+    "lastEvaluated": "最后检查",
+    "shareNoQuotaHint": "未设配额，故无占比。请到项目「隔离」分页设定配额。",
+    "setQuotaLink": "设定配额",
+    "unusualHome": "非标准路径",
+    "unusualHomeHint": "不是 /home/... 项目主页。规范隔离是 /home/ysk-server-{id}。",
+    "protectedPid": "无法从面板发出 PID 1 / init / systemd 信号",
+    "sigTermTitle": "发送SIGTERM（要求进程退出）",
+    "sigKillTitle": "发送SIGKILL（强制杀死——无法被捕获）",
+    "batchTerm": "TERM",
+    "batchKill": "杀",
+    "rawTopLabel": "原始上衣（未翻译）",
+    "followSseLabel": "关注（直播）",
+    "alertsReadOnly": "仅内置 CPU/内存/磁盘阈值。没有电子邮件、网络钩子或 Slack 通道。",
+    "alertsGoNotifications": "打开通知中心",
+    "lastCheck": "最后检查",
+    "rawTopHint": "未翻译的 top(1) 输出",
+    "load1m": "Load 1m",
+    "uptime": "Uptime",
+    "filterCpu5": "≥5% CPU",
+    "filterMem5": "≥5% memory",
+    "signalHint": "Select a process, then send TERM or KILL.",
+    "signalFromRow": "Select this process for TERM / KILL",
+    "selectForSignal": "Select",
+    "forceKillTitleNamed": "KILL PID {{pid}} ({{cmd}})?",
+    "sendSigTitleNamed": "Send TERM to PID {{pid}} ({{cmd}})?",
+    "controlPlaneNoSignal": "The control-plane process cannot be signalled"
   },
   "migrate": {
     "tabInventory": "盘点",
@@ -4581,6 +5377,10 @@
     "restartApiHint": "若刚部署新版本，请重启 API（",
     "afterRestart": "）后再按「刷新」。",
     "inventoryWarnings": "盘点警告（{{count}}）",
+    "orphanHomesHint": "孤立项目主目录（store 无对应）。确认无用途后再删。",
+    "orphanRemove": "删除孤立主目录",
+    "orphanRemoveTitle": "删除此孤立项目主目录？",
+    "orphanRemoveDesc": "将永久删除磁盘上的 {{path}}。这不是 store 内项目。需 YSK_EXECUTE=1。",
     "moreWarnings": "…另有 {{n}} 則",
     "authPassword": "root 密码（安装临时密钥后改用 key）",
     "authIdentity": "SSH 身份庫 identityId",
@@ -4593,7 +5393,16 @@
     "dryRunOnlyDesc": "· 只做盘点 + 预检，不 rsync、不写目标",
     "executeNote": "本机需 YSK_EXECUTE=1 且以 root 执行 API。迁移完成后请改 DNS A/AAAA，并检查雲防火墙与邮件 PTR。",
     "dnsCutover": "DNS cutover（需人工）",
-    "dnsCutoverDesc": "将下列主机名的 A / AAAA 指到新机公网 IP；并确认 80/443/25/587 等防火墙与邮件 rDNS。"
+    "dnsCutoverDesc": "将下列主机名的 A / AAAA 指到新机公网 IP；并确认 80/443/25/587 等防火墙与邮件 rDNS。",
+    "orphanRemovePhrase": "请输入 DELETE 确认。",
+    "orphanRemoveNeedConfirm": "需确认",
+    "passwordNotStored": "Password is used for this SSH session only and is not saved on disk.",
+    "overwriteDanger": "Overwrite will replace existing YSK data on the target. This cannot be undone from the panel.",
+    "orphanBackupFirst": "Back up first (open Backups)",
+    "expandAllWarnings": "Show all {{n}} warnings",
+    "collapseWarnings": "Show fewer",
+    "inventoriedWarn": "Inventoried · {{n}} warnings",
+    "orphanMtime": "Last modified {{at}}"
   },
   "multiCheck": {
     "customPlaceholder": "自定义代码",
@@ -4670,7 +5479,9 @@
       "runtimes": "运行环境",
       "security": "安全",
       "system": "系统",
-      "ai": "人工智能"
+      "ai": "人工智能",
+      "validators": "验证者节点",
+      "containers": "容器"
     },
     "java": "Java",
     "kotlin": "Kotlin",
@@ -4689,8 +5500,13 @@
     "bookmarkPinned": "已固定",
     "bookmarkAdded": "已固定到侧栏",
     "bookmarkRemoved": "已从侧栏移除",
-    "btTracker": "BT追踪器",
-    "support": "支持"
+    "btTracker": "BT Tracker",
+    "support": "支持",
+    "noAccessTitle": "没有权限",
+    "noAccessDesc": "你的角色不能开启此页。如需使用，请向管理员申请。",
+    "backToDashboard": "返回仪表板",
+    "validators": "验证者节点 (Beta)",
+    "docker": "Docker"
   },
   "network": {
     "title": "网络接口",
@@ -4705,7 +5521,7 @@
     "tabs": {
       "ifaces": "接口",
       "routes": "路由",
-      "dns": "DNS",
+      "dns": "域名系统",
       "advanced": "高级",
       "about": "说明",
       "realip": "真实 IP / CDN"
@@ -4797,6 +5613,8 @@
     "applyDnsNotes": "套用后会 nmcli connection modify + up；短暂断线属正常。stub 127.0.0.53 不会写入（本机 resolved 内部用）。",
     "testResolve": "测试解析",
     "loadRaw": "加载 raw 输出",
+    "hideRaw": "隐藏 raw 输出",
+    "rawLoadedAt": "加载时间 {{time}}",
     "confirmDown": "确认 Down",
     "defaultRouteDownWarn": "此接口是默认路由出口，down 后可能无法连上管理面板。",
     "deleteDefaultMayDrop": " — 删除 default 可能断线。",
@@ -4829,10 +5647,31 @@
         "azure_frontdoor": "蔚蓝前门",
         "gcore": "国核CDN",
         "custom": "自定义代理"
-      }
+      },
+      "needProvider": "请先选择 CDN 供应商，才可更新 IP 列表。",
+      "spoofWarn": "信任错误的 CIDR 会让客户端伪造 X-Forwarded-For／CDN 标头，假装成真实来源 IP。"
     },
     "linkUp": "向上",
-    "linkDown": "断开"
+    "linkDown": "断开",
+    "linkDownTitle": "將 {{name}} 離線",
+    "linkDownNeedConfirm": "需輸入介面名稱確認",
+    "persistNmHint": "可持久化代表经 NetworkManager 写入后，重启后设定仍然有效。",
+    "deleteDefaultPanelWarn": "删除默认路由可以删除此面板会话。键入 DEFAULT 进行确认。",
+    "typeDefaultToConfirm": "输入 DEFAULT 进行确认",
+    "deleteDefaultNeedConfirm": "需确认 — 请输入 DEFAULT（可能中断本面板）",
+    "deleteRouteNeedConfirm": "需确认",
+    "nmUnavailable": "NetworkManager 未运行 — 只能添加实时路由",
+    "defaultRouteDownNeedName": "这是默认路由出口。输入接口名称进行确认 - 面板可能会断开连接。",
+    "linkDownDefault": "Down default route",
+    "loopbackImmutable": "Loopback cannot be changed",
+    "operUnknownHint": "Kernel did not report UP/DOWN (common for lo). The interface is still usable.",
+    "statUp": "Up",
+    "oper": {
+      "up": "Up",
+      "down": "Down",
+      "unknown": "Unknown",
+      "other": "Other"
+    }
   },
   "nginx": {
     "pillSites": "{{count}} 站点",
@@ -4902,7 +5741,7 @@
     "siteSettings": "站点设置",
     "saveApply": "保存并应用",
     "settingsSaved": "已保存",
-    "setGzip": "Gzip",
+    "setGzip": "压缩包",
     "setShowVersion": "显示版本号",
     "setShowVersionDesc": "关 = server_tokens off",
     "setHttp2": "HTTP/2（SSL）",
@@ -4918,6 +5757,12 @@
     "setIndexes": "目录列表",
     "bodyInherit": "跟随全局"
   },
+  "notFound": {
+    "title": "找不到页面",
+    "body": "{{path}} 处没有面板页面。",
+    "hint": "未知 URL 不再将您发送至仪表板。",
+    "home": "仪表板"
+  },
   "notes": {
     "notFound": "找不到",
     "needPath": "请指定路径",
@@ -4950,16 +5795,42 @@
     },
     "ssh": {
       "identityNotFound": "找不到 identity",
-      "registrationNotFound": "找不到登记"
+      "registrationNotFound": "找不到登记",
+      "keyOkNologin": "Key accepted. Account has no login shell (nologin) — use SFTP. Treated as PASS.",
+      "keyOkSftp": "SSH shell 被拒绝后，SFTP pwd 成功。"
     },
     "cdn": {
       "siteNotFound": "找不到 CDN 站点",
-      "nodeMissing": "节点不存在"
+      "nodeMissing": "节点不存在",
+      "probe": {
+        "timeout": "连接超时 {{ms}}ms（{{detail}}）。对端可能被防火墙挡住。",
+        "dns": "DNS 查询失败（{{detail}}）。",
+        "refused": "连接被拒 {{ms}}ms（{{detail}}）。端口未开或单向封锁。",
+        "tls": "TLS 验证失败（{{detail}}）。",
+        "unreach": "主机不可达 {{ms}}ms（{{detail}}）。",
+        "http": "HTTP 探活失败 {{ms}}ms（{{detail}}）。"
+      },
+      "loopbackOriginRemote": "来源是 127.0.0.1 — 这是该主机，而不是远程边缘。设置可达的源IP或bind_ip。",
+      "needSshOrFleet": "远程边缘需要出站 SSH 身份（或用户名）或 /agents 队列会话。仅健康 URL 不适用传输。",
+      "originRemoteRewrite": "远程边缘将使用可达源 {{url}} 而不是环回。",
+      "originRemoteUnknown": "来源是环回，并且没有已知的公共/LAN IP 或bind_ip — apply 将拒绝远程边缘，直到设置为止。"
     },
     "backup": {
+      "testUnsaved": "正在测试未保存的表单（尚未写入设置）。",
       "fileNotFound": "找不到备份文件",
       "resticNoPassword": "restic 已启用但未设置 password",
-      "resticNotInPath": "restic 不在 PATH"
+      "resticNotInPath": "restic 不在 PATH",
+      "dbEnvUnreadable": "无法读取 .db.env，跳过 SQL 导出。",
+      "dbEnvNoName": ".db.env 没有数据库名称，跳过 SQL 导出。",
+      "targetOutside": "还原目标必须在项目家目录或公开文件根目录之内。",
+      "testIdentity": "ssh (identity) to {{spec}} ok",
+      "sshAuthFailed": "SSH 密钥或密码被拒绝（公钥）。选择出站身份或安装 sshpass。",
+      "remotePathIsFile": "远程路径 {{path}} 是一个文件。使用目录。",
+      "remoteMkdirFailed": "无法创建远程目录：{{detail}}",
+      "sidecarPushed": "还推送了 SQL sidecar {{name}}",
+      "controlPlaneDryRun": "仅预览 - 没有写任何东西。在面板中，使用“恢复”并确认要写入的短语。",
+      "controlPlaneNeedConfirm": "完全控制平面恢复需要确认短语 RESTORE-CONTROL-PLANE。",
+      "controlPlaneRestartAfter": "恢复成功后重新启动API。"
     },
     "redis": {
       "cliMissing": "未安装 redis-cli"
@@ -5003,7 +5874,8 @@
       "pathOutsideSandbox": "路径超出沙箱范围：{{target}}",
       "notFoundRel": "找不到：{{relPath}}",
       "fileNotFoundRel": "找不到文件：{{relPath}}",
-      "notFoundFrom": "找不到：{{fromPath}}"
+      "notFoundFrom": "找不到：{{fromPath}}",
+      "alreadyExists": "已有同名项目：{{name}}"
     },
     "dns": {
       "needZoneServerIp": "请填写 zone 与 server IP",
@@ -5043,7 +5915,10 @@
     },
     "db": {
       "needExecuteCreate": "服务器未开启系统变更权限，无法在管理面板创建数据库",
-      "dryRunMysql": "dry-run：未创建数据库。加 --execute 且 YSK_EXECUTE=1 才真正 provision"
+      "dryRunMysql": "dry-run：未创建数据库。加 --execute 且 YSK_EXECUTE=1 才真正 provision",
+      "remoteNoCreds": "未存账号／密码——只测 TCP（登记 ≠ 已登录）。",
+      "remoteReachable": "TCP {{host}}:{{port}} 可达（{{ms}}ms）。",
+      "remoteUnreachable": "TCP {{host}}:{{port}} 关闭或被过滤（{{ms}}ms）。"
     },
     "net": {
       "invalidIface": "接口名称无效",
@@ -5121,10 +5996,20 @@
       "security": "安全",
       "binaries": "二进制／软件包",
       "hosting": "托管",
-      "dns": "DNS",
+      "dns": "域名系统",
       "email": "邮件",
       "isolation": "项目隔离",
-      "ops": "运维"
+      "ops": "运维",
+      "runtimesNode": "Node.js",
+      "runtimesPhp": "PHP",
+      "runtimesPython": "Python",
+      "runtimesGo": "Go",
+      "pm2": "PM2",
+      "runtimesNodeFix": "从 /runtimes/node 安装 Node",
+      "runtimesPhpFix": "从 /runtimes/php 安装 PHP",
+      "runtimesPythonFix": "从 /runtimes/python 安装 Python",
+      "runtimesGoFix": "从 /runtimes/go 安装 Go",
+      "pm2Fix": "从 Node 运行时页面安装 PM2"
     },
     "needAdmin": "需要管理员权限",
     "notInstalled": "未安装",
@@ -5397,7 +6282,7 @@
       "n0259": "domain 必填",
       "n0260": "domain 找不到",
       "n0261": "dovecot reload 失败或服务未裝（sieve 檔已寫；唔標假 reload 成功）",
-      "n0262": "dry-run fleet dispatch（未入佇列）",
+      "n0262": "预览试行机群派送（未入队列）",
       "n0263": "dry-run peer push 計劃（未 scp）",
       "n0264": "dry-run remote install（未 ssh）",
       "n0265": "dry-run transfer 完成（略過 full bootstrap）",
@@ -5534,7 +6419,7 @@
       "n0396": "python3 可执行檔",
       "n0397": "queued ≠ edge 已 purge",
       "n0398": "queued ≠ edge 已 reload — agent 需拉取並执行 cdn.edge.apply",
-      "n0399": "queued ≠ edge 已执行 — Agents 紀錄睇 exit/JSON",
+      "n0399": "queued ≠ edge 已执行 — Agents 纪录看 exit/JSON",
       "n0400": "realpath 快取大小",
       "n0401": "realpath 快取秒數",
       "n0402": "reapply 需要 YSK_EXECUTE=1",
@@ -6260,7 +7145,7 @@
       "n1120": "無暫停域名 — map 為空（系統应用後會 postmap 空檔）",
       "n1121": "無有效 IP",
       "n1122": "無模組時政策仍可用於嫌疑人 auto-ban enrich",
-      "n1123": "无法 ban 到系統：需 YSK_EXECUTE；已記到面板 ban 清單",
+      "n1123": "無法封鎖到主機：未開啟系統變更權限。面板清單沒有新增。",
       "n1124": "无法 dump Redis：缺 redis-cli",
       "n1125": "无法 dump：服务器未开启系統变更权限",
       "n1126": "无法 fan-out：未开启系統变更权限",
@@ -6730,7 +7615,7 @@
       "n1590": "靜態網站",
       "n1591": "非 root — useradd／systemd／nginx 系統路径受限",
       "n1592": "非受限 seccomp 需要明確指定 runAsUser",
-      "n1593": "面板請求/分",
+      "n1593": "公开请求／分钟",
       "n1594": "面板连接即將中斷；可用「取消排程」撤回（若仍在線）",
       "n1595": "面板非 root",
       "n1596": "預覽可用 apply:false",
@@ -6748,6 +7633,8 @@
       "n1608": "验证碼无效",
       "n1609": "验证通过",
       "n1610": "未刷新套件索引（未开 YSK_EXECUTE）— 仅显示 apt list；开启 EXECUTE 才运行 apt-get update",
+      "n1611": "UFW 已關閉：user.rules 有 {{n}} 條永久拒規則，但核心未強制執行。",
+      "n1612": "UFW 已關閉。拒絕規則只會寫入 user.rules，核心不會丟棄封包。請先啟用 UFW。不會自動開啟。",
       "t0001": "listenPort 无效：{{v0}}",
       "t0002": "已還原版本 {{v0}}",
       "t0003": "文件過大（>{{v0}} bytes）",
@@ -7001,7 +7888,7 @@
       "t0251": "{{v0}} 安装未完成",
       "t0252": "{{v0}} 服務已启动",
       "t0253": "启动失败：{{v0}}",
-      "t0254": "不支援的 Node.js 版本 {{v0}}；可用主版本：{{v1}}",
+      "t0254": "支持 Node.js 版本 {{v0}}；可用版本：{{v1}}",
       "t0255": "不支援的 PHP 版本 {{v0}}；可用：{{v1}}",
       "t0256": "不支援的 Python 版本 {{v0}}；可用：{{v1}}",
       "t0257": "不支援的 Go 版本 {{v0}}；可用：{{v1}}",
@@ -7123,12 +8010,12 @@
       "t0373": "项目「{{v0}}」隔離",
       "t0374": "已複製到本機路径 {{v0}}",
       "t0375": "身份 {{v0}}：{{v1}}",
-      "t0376": "已 scp（identity）到 {{v0}}",
-      "t0377": "scp(identity) 失败: {{v0}}",
-      "t0378": "已 scp 到 {{v0}}",
-      "t0379": "scp 失败: {{v0}}",
-      "t0380": "已 scp 到 {{v0}}",
-      "t0381": "scp 失败: {{v0}}（可設 backup remote identityId）",
+      "t0376": "sftp（身份密钥）连到 {{v0}} 成功",
+      "t0377": "sftp（身份密钥）失败：{{v0}}",
+      "t0378": "sftp 连到 {{v0}} 成功",
+      "t0379": "sftp 失败：{{v0}}",
+      "t0380": "sftp 连到 {{v0}} 成功",
+      "t0381": "sftp 失败：{{v0}}（可设置备份 remote identityId）",
       "t0382": "已上傳 S3 {{v0}}",
       "t0383": "S3 失败: {{v0}}",
       "t0384": "政策已開：{{v0}}/{{v1}} admin 已啟用 2FA",
@@ -7136,7 +8023,7 @@
       "t0386": "{{v0}} 在 PATH",
       "t0387": "{{v0}} 找不到",
       "t0388": "請於系統安装 {{v0}}，或於面板软件／runtime 安装",
-      "t0389": "可用主版本：{{v0}}",
+      "t0389": "可用版本：{{v0}}",
       "t0390": "使用率約 {{v0}}%（總 {{v1}} MB）",
       "t0391": "使用率約 {{v0}}%（{{v1}}）",
       "t0392": "於服務矩陣启动 {{v0}}",
@@ -7385,7 +8272,7 @@
       "t0635": "无法探测 {{v0}}",
       "t0636": "來源 {{v0}} · {{v1}}",
       "t0637": "项目 {{v0}} · 信箱 {{v1}} · DB {{v2}} · Redis {{v3}}",
-      "t0638": "需安装软件 {{v0}} 項 · homes {{v1}}",
+      "t0638": "需安装软件 {{v0}} 项 · homes {{v1}}",
       "t0639": "cutover 主機名 {{v0}}",
       "t0640": "警告 {{v0}} 則（請審閱）",
       "t0641": "已產生臨時密钥 {{v0}}",
@@ -7472,7 +8359,7 @@
       "t0722": "originShieldNodeId={{v0}} 不存在 — 忽略 shield",
       "t0723": "{{v0}}: 有 SSH 目標 — 使用 SSH 同步应用（略過 fleet 佇列）",
       "t0724": "fleet 无法入佇列（blocked={{v0}}）— 提供 enqueue 或改用 SSH",
-      "t0725": "fleet 已入佇列 {{v0}} edge — queued ≠ agent 已 nginx reload；睇 Agents 指令紀錄",
+      "t0725": "fleet 已入队列 {{v0}} edge — queued ≠ agent 已 nginx reload；查看 Agents 指令纪录",
       "t0726": "fleetAgentId={{v0}} — 需要控制面 fleet enqueue（API 會注入）；或改填 SSH 做同步应用",
       "t0727": "找不到 conf：{{v0}}",
       "t0728": "讀 conf 失败：{{v0}}",
@@ -7547,7 +8434,14 @@
       "t0797": "timezone 失败: {{v0}}",
       "tScoreFrom": "分数={{score}} · 由 {{from}} 切换",
       "appliedTag": "（已应用）",
-      "writtenTag": "（只写文件）"
+      "writtenTag": "（只写文件）",
+      "selfDestMissing": "找不到运行中安装目录（systemd ExecStart 或运行中 cli.js）",
+      "selfDestUnwritable": "无法写入运行中安装目录 {{v0}}",
+      "selfApplied": "已将 {{v0}} 应用到 {{v1}}",
+      "selfVerifyFail": "应用后版本文件未包含 {{v0}}",
+      "selfDownloadFail": "无法下载或解压官方套件 {{v0}}：{{v1}}",
+      "selfOverlayFail": "官方套件未能应用到运行中目录：{{v0}}",
+      "selfUpgradeHint": "面板套用失败。请以 root 执行：curl -fsSL https://raw.githubusercontent.com/yanshekki/ysk-server/main/install.sh | bash -s -- --upgrade"
     },
     "tpl": {
       "deleted": "已删除 {{name}}",
@@ -7777,7 +8671,10 @@
       "accessReconnectHint": "已连接的客户端请断开再连，才会使用新路由",
       "ovpnNatDurable": "安装 OpenVPN NAT/转发以便重新启动 (systemd ExecStartPost)。",
       "clientFullTunnelProtect": "检测到全隧道客户端 (AllowedIPs 0.0.0.0/0)。应用主机保护，以便面板/SSH 回复保留在 LAN NIC 上。",
-      "clientFullTunnelHint": "提示：仅对于分割访问，请在conf中将AllowedIPs设置为VPN/LAN CIDR（而不是0.0.0.0/0），然后重新连接。"
+      "clientFullTunnelHint": "提示：仅对于分割访问，请在conf中将AllowedIPs设置为VPN/LAN CIDR（而不是0.0.0.0/0），然后重新连接。",
+      "serverStopped": "已停止 {{engine}} 伺服器。",
+      "serverStopFailed": "無法停止 {{engine}} 伺服器：{{detail}}",
+      "peersSynced": "Peer list reloaded on the running WireGuard interface."
     },
     "vnc": {
       "needInstall": "请安装 {{stack}}",
@@ -7871,7 +8768,12 @@
       "clientDeleted": "已删除客户端配置",
       "sessionStartCwd": "VNC 启动失败：工作目录会话用户无权访问（display :{{display}}）。已改为从 HOME 启动。",
       "desktopRestarted": "应用桌面配置文件并重新启动会话 ({{desktop}})。重新连接 VNC/noVNC。",
-      "desktopNeedsStart": "桌面配置文件 {{desktop}} 写入 xstartup。启动会话以进行申请。"
+      "desktopNeedsStart": "桌面配置文件 {{desktop}} 写入 xstartup。启动会话以进行申请。",
+      "passwordNeedTiger": "找不到 vncpasswd。请先安装 TigerVNC（tigervnc-standalone-server）再设定密码。",
+      "linuxUserRolledBack": "VNC 密码失败后已删除遗留 Linux 用户 {{user}}。",
+      "linuxUserOrphan": "VNC 密码失败后无法删除遗留 Linux 用户 {{user}}。",
+      "sessionStartHostname": "Failed to start display :{{display}}: this host cannot resolve its own hostname. Add the hostname to /etc/hosts (or fix DNS) then start the session again.",
+      "userdelLeftover": "Panel account removed, but Linux user {{user}} is still on the host. Remove it from Users or the host."
     },
     "apache": {
       "needServerName": "需要域名",
@@ -7921,7 +8823,102 @@
       "startedDetached": "BT Tracker detached worker 已启动（pid {{pid}}，端口 {{port}}）",
       "runningDetached": "Tracker 以 detached worker 运行中（pid {{pid}}）",
       "jobQueued": "BT torrent 创建已排入队列（大型分享）",
-      "jobRunning": "正在创建 BT torrent"
+      "jobRunning": "正在创建 BT torrent",
+      "libraryAdded": "已将 {{name}} 加入 WebTorrent 资料库",
+      "libraryInspectFailed": "无法读取此 .torrent 或 magnet",
+      "libraryDup": "资料库已有此 Torrent",
+      "libraryDestBad": "保存位置不是有效的文件路径",
+      "libraryTorrentTooBig": ".torrent 文件大于 8 MiB",
+      "libraryNotFound": "找不到此资料库项目",
+      "libraryPaused": "已暂停",
+      "libraryResumed": "已继续",
+      "libraryRemoved": "已从资料库移除",
+      "libraryFilesRemoved": "已删除下载的文件",
+      "libraryRestoreDone": "资料库还原：已启动 {{started}}/{{attempted}}（失败 {{failed}}）",
+      "applyTrackersDone": "已向 {{n}} 个现有 announce 套用常用 Tracker",
+      "libraryNeedServe": "已保存。请在面板启动 ysk-server serve，WebTorrent 才会下载／做种。",
+      "libraryDestIsFile": "无法建立名为 {{name}} 的文件夹——该处已有同名文件。",
+      "librarySeedMissing": "此文件夹没有可做种的对应文件。",
+      "libraryWaitingPeers": "正在等待 peers。若文件已在此主机，请重新加入并选使用现有文件做种。"
+    },
+    "migrate": {
+      "orphanConfirm": "请输入完整孤立主目录路径以确认删除。",
+      "orphanStillInStore": "该主目录仍属于 store 内的项目。",
+      "orphanMissing": "磁盘没有此路径：{{path}}",
+      "orphanNeedExecute": "将删除孤立主目录 {{path}}。需 YSK_EXECUTE=1。",
+      "orphanRmFailed": "无法删除孤立主目录：{{detail}}",
+      "orphanRemoved": "已删除孤立项目主目录 {{path}}。"
+    },
+    "leftover": {
+      "staleCliTitle": "遗留旧版 CLI",
+      "staleCli": "仍有旧 CLI：{{path}}（产品版本 {{version}}）。PATH 可能优先使用它。移除：rm -f {{path}}",
+      "apacheDefaultTitle": "Apache 遗留默认站",
+      "apacheDefault": "Apache 000-default 仍占 :80。产品 overlay 不会停用。请在面板套用 Apache，或 hosting apache apply --execute。",
+      "nginxCatchAllTitle": "Nginx 缺 catch-all",
+      "nginxCatchAll": "/etc/nginx/conf.d 没有 ysk-000-default.conf。未知 SNI 可能落到其他站。请执行 projects nginx-sync --execute。",
+      "vsftpdTitle": "vsftpd 单元失败",
+      "vsftpd": "vsftpd 失败。overlay 不会重写 listen／listen_ipv6。请在面板套用 FTP。",
+      "dovecotTitle": "Dovecot TLS 指向不存在的证书",
+      "dovecot": "Dovecot ssl_cert 指向不存在的 {{path}}。overlay 不会改成 ssl=no。签发邮件证书后套用邮件 TLS。",
+      "overlayDoesNotHeal": "产品 overlay 不会改写 nginx、Apache、vsftpd 或 Dovecot。请用列出的套用命令（root + YSK_EXECUTE=1）。",
+      "readinessTitle": "overlay 后主机遗留",
+      "readinessClean": "未检测到 Apache 默认站、缺 nginx catch-all、vsftpd 失败或旧 CLI。",
+      "staleCliRemoved": "已移除残留 CLI {{path}}。",
+      "staleCliRemoveFailed": "无法移除残留 CLI {{path}}：{{detail}}",
+      "vsftpdSslOff": "因 FTPS 证书文件不存在，已将 vsftpd 设为 ssl_enable=NO 并重新启动。",
+      "dovecotSslOff": "因 {{path}} 不存在，已将 Dovecot 设为 ssl=no 并重新启动。"
+    },
+    "git": {
+      "missingBin": "git 不在路径上",
+      "auth": "认证失败。添加部署密钥或 HTTPS 令牌。",
+      "hostkey": "SSH 主机密钥验证失败。确认并固定主机密钥。",
+      "dirty": "工作树有 {{count}} 个本地更改。拉动被阻止。",
+      "diverged": "无法快进。如果您打算丢弃本地 Git 历史记录，请重置为远程引用。",
+      "missingRef": "该分支、标签或提交不在远程上。",
+      "shallow": "这个克隆很浅。在固定旧提交之前获取完整历史记录。",
+      "notRepo": "app/ 还不是 Git 存储库。",
+      "unrelated": "无关的历史。仅在确认后重新克隆 - 自定义文件将丢失。",
+      "lock": "Git index.lock 存在。仅当没有 git 进程正在运行时才将其删除。",
+      "disk": "磁盘已满或超出配额。",
+      "timeout": "Git 超时。",
+      "network": "与远程通信时出现网络错误。",
+      "lfs": "此存储库使用 Git LFS 并且 git-lfs 不可用。",
+      "submodule": "子模块更新失败。",
+      "unknown": "吉特失败了。查看命令输出。",
+      "fetchOk": "从原产地获取。",
+      "checkoutOk": "签出{{ref}}。",
+      "resetOk": "硬重置为{{ref}}。",
+      "envRestored": "从控制平面恢复了 app/.env。",
+      "needPinHost": "SSH 主机密钥未固定。在克隆或获取之前扫描并固定它。",
+      "tokenSaved": "已存储 HTTPS 令牌（不再显示）。",
+      "tokenCleared": "HTTPS 令牌已删除。",
+      "tokenInvalid": "令牌必须至少包含 8 个字符。",
+      "deployKeyCreated": "已创建部署密钥。在 Git 主机上添加公钥。",
+      "deployKeyCleared": "部署与该项目分离的密钥。",
+      "hostPinned": "{{host}} 的固定 SSH 主机密钥。",
+      "hostUnpinned": "清除固定的 SSH 主机密钥。",
+      "hostScanFailed": "ssh-keyscan 没有返回该主机的密钥。",
+      "hookEnabled": "入站 Git 挂钩已打开。自行将 URL 粘贴到 GitHub、Gitea 或 GitLab 中。",
+      "hookDisabled": "入站 Git 挂钩已关闭。 URL 将不会同步。",
+      "hookSecretOnce": "现在复制这个钩子秘密。它不再显示。",
+      "refsNeedUrl": "首先输入 Git URL。",
+      "refsOk": "已加载 {{branches}} 分支和 {{tags}} 标签。",
+      "refsEmpty": "远程没有发布任何分支或标签。",
+      "diffEmpty": "没有未暂存的差异（受保护的 .env 被排除）。"
+    },
+    "defense": {
+      "panelReqLabel": "面板请求数/分钟",
+      "panelReqExcluded": "经过身份验证的面板流量 - 此处显示，不计入威胁评分",
+      "tcpOk": "TCP {{target}} 可达",
+      "tcpFail": "TCP {{target}} 失败",
+      "dnsDegraded": "DNS 路径降级",
+      "reqRateHigh": "公开请求率 {{reqs}}/min ≥ {{threshold}}",
+      "ddosHeuristic": "高公共请求率加上边缘探测失败"
+    },
+    "publicFiles": {
+      "liveConf": "生效 Nginx 配置文件：{{path}}",
+      "publicRoot": "公开根目录：{{path}}",
+      "confNameStale": "配置文件 {{file}} 与当前 server_name {{serverName}} 不一致。请再套用公用文件以改名。"
     }
   },
   "ops": {
@@ -8123,7 +9120,12 @@
       "httpStatus": "HTTP",
       "latency": "延遲",
       "error": "错误",
-      "at": "检查时间"
+      "at": "检查时间",
+      "deployMode": "Deploy mode",
+      "edgeKind": "Edge",
+      "goLiveOk": "Go-live",
+      "goLiveAt": "Go-live at",
+      "degraded": "Degraded"
     },
     "railPhp": "PHP / 站点",
     "railStatic": "静态站",
@@ -8557,11 +9559,11 @@
       "node": "Node.js",
       "static": "静态",
       "python": "Python",
-      "go": "Go",
+      "go": "去",
       "rust": "Rust",
       "java": "Java",
       "kotlin": "Kotlin",
-      "bun": "Bun"
+      "bun": "包子"
     },
     "netCacheTitle": "缓存",
     "logsDeepAccess": "日志中心 · access",
@@ -8574,7 +9576,7 @@
     "railBun": "Bun 进程",
     "deployProcessManager": "进程管理",
     "deployProcessManagerSystemd": "systemd（推荐）",
-    "deployProcessManagerPm2": "颗粒物",
+    "deployProcessManagerPm2": "PM2",
     "proc_restart": "重启",
     "proc_stop": "停止",
     "proc_reload": "重新加载",
@@ -8598,16 +9600,132 @@
     "netPublishMaint": "维护",
     "sslNeedDomain": "请先填写域名，才能发布 Nginx / SSL。",
     "createTemplateMissing": "未載入 {{v0}} 範本；請重新整理或選「— 無 —」空白專案。",
-    "deleteDialogDesc": "將銷毀「{{v0}}」。此操作無法還原。",
+    "deleteDialogDesc": "將銷毀「{{name}}」。此操作無法還原。",
     "deleteWillStop": "停止 systemd / PM2 / 本機進程",
     "deleteWillWeb": "移除 Nginx conf、PHP-FPM pool、Apache vhost（如有）",
     "deleteWillOs": "刪除 Linux 用戶與 home 目錄（安全路徑）",
     "deleteKeepOs": "保留 home 與 Linux 用戶（僅面板移除）",
     "deleteWillDb": "從控制面資料庫移除專案",
     "deleteRemoveFilesDesc": "取消勾選則只從面板移除，檔案與系統用戶保留",
-    "deleteTypeNameHint": "請輸入「{{v0}}」",
+    "deleteTypeNameHint": "請輸入「{{name}}」",
     "deleteDnsWarn": "共享 DNS zone / 郵箱 domain 不會自動刪除。",
-    "manageInNginx": "在 Nginx 管理"
+    "manageInNginx": "在 Nginx 管理",
+    "advFtpHomeApp": "站点 app 目录",
+    "advFtpHomeRoot": "项目家目录（全部）",
+    "advFtpManage": "打开 FTP 页",
+    "listDesc": "管理该主机上的站点。",
+    "resShell": "登录 shell",
+    "resSaveHint": "「储存并套用」会改主机。「仅存控制面」只记表单。「再套用」用已存值再写入系统。",
+    "resBashConfirmTitle": "允许互动式 bash？",
+    "resBashConfirmDesc": "这会让专案用户有互动登录 shell。只在需要以该用户 SSH 或终端机时才确认。",
+    "noPathSepHint": "名稱不可包含 / 或 \\。",
+    "createGitHint": "可选。会记在专案；到部署分页再 clone（建立时不会 clone）。",
+    "gitBranch": "分支",
+    "gitBranchHint": "分支或 tag。留空则用远端默认分支。首次 clone 为浅层（depth 1）。",
+    "gitLastRef": "上次同步：{{branch}} @ {{commit}}",
+    "gitConfirmTitle": "要 clone 到此专案？",
+    "gitConfirmBody": "若 app/ 仍是 Hello World 占位会先清除再 clone。非 YSK 模板的自定义文件会拒绝覆盖。",
+    "gitConfirmRemoteBody": "会把 origin 改为新网址再 pull。历史无关则失败；不会清除自定义文件。",
+    "runtimeActual": "实际 binary {{path}}",
+    "runtimeFallback": "所选 {{version}} 并未安装。进程实际使用 {{path}}。",
+    "gitSync": "同步",
+    "gitFetch": "拿来",
+    "gitCheckout": "查看",
+    "gitReset": "重置为远程",
+    "gitDeepen": "获取完整历史记录",
+    "gitLogTitle": "最近的提交",
+    "gitDirtyTitle": "本地更改阻止拉动",
+    "gitDirtyBody": "{{count}} 个文件与 Git（文件编辑或应用程序）不同。丢弃它们或中止。",
+    "gitDiscard": "丢弃本地文件",
+    "gitOpenFiles": "在文件中打开",
+    "gitNotCloned": "未克隆",
+    "gitClean": "干净的",
+    "gitDirty": "肮脏的",
+    "gitBehind": "落后于 {{count}}",
+    "gitAhead": "领先 {{count}}",
+    "gitDetached": "已固定",
+    "gitShallow": "浅的",
+    "gitMissing": "git 丢失",
+    "gitResetConfirmTitle": "重置很难远程？",
+    "gitResetConfirmBody": "这将丢弃本地 Git 历史记录和除 .env 之外的未跟踪文件，然后从控制平面恢复 .env。",
+    "gitHeads": "远程分支机构",
+    "gitToken": "HTTPS 令牌",
+    "gitTokenHint": "Personal access token. Stored encrypted; never written into the remote URL.",
+    "gitTokenPlaceholder": "ghp_... 或 glpat-...",
+    "gitTokenSet": "令牌集",
+    "gitSaveToken": "保存令牌",
+    "gitClearToken": "清除令牌",
+    "gitDeployKey": "部署公钥",
+    "gitDeployKeyHint": "将其添加为 Git 主机上的只读部署密钥。",
+    "gitDeployKeyOn": "部署密钥",
+    "gitMakeKey": "创建部署密钥",
+    "gitCopyPub": "复制公钥",
+    "gitClearKey": "清除部署密钥",
+    "gitKeyCopied": "公钥已复制",
+    "gitPinHost": "固定主机密钥",
+    "gitPinHostBody": "{{host}} 未固定。确认指纹，然后在 SSH 克隆之前进行固定。",
+    "gitHostUnpinned": "主机密钥未固定",
+    "gitHookTitle": "Inbound hook",
+    "gitHookHint": "请自行把上方完整 POST URL 贴到 GitHub／Gitea／GitLab（只接收 push）。不是 Slack。密钥用 HMAC 或 X-YSK-Git-Hook。只会同步本项目已选定的 ref。",
+    "gitHookOn": "Hook 已开",
+    "gitHookOff": "Hook 已关",
+    "gitHookEnable": "开启 hook",
+    "gitHookRotate": "更换 secret",
+    "gitHookDisable": "关闭 hook",
+    "gitHookSecretOnce": "请立即复制此 secret——离开页面后不会再显示。",
+    "gitHookCopyUrl": "复制 URL",
+    "gitHookCopySecret": "复制 secret",
+    "gitHookCopied": "已复制",
+    "gitHookSetup": "请在 Git 平台自行新增 webhook：Payload URL 用上方完整网址；Content type 用 application/json；事件只选 push；Secret 用启用时显示的值。",
+    "gitHookGithub": "GitHub：Settings → Webhooks → Add webhook。Content type 选 application/json。Events 选 Just the push event。GitHub.com 需要 HTTPS。",
+    "gitHookGitea": "Gitea：Settings → Webhooks → Add Webhook → Gitea。方法 POST。事件选 Push。",
+    "gitHookGitlab": "GitLab：Settings → Webhooks。Trigger 选 Push events。Secret token 填 hook secret（以 X-Gitlab-Token 传送）。",
+    "gitHookHonesty": "主机 systemd 必须设 YSK_EXECUTE=1，hook 才会真正 clone／部署。否则只回计划结果。",
+    "gitHookSkipOther": "其他分支的 push 会被忽略，只同步本项目的 ref。",
+    "gitAuthHttps": "HTTPS 令牌",
+    "gitAuthSsh": "SSH 部署密钥",
+    "gitLoadRefs": "加载分支",
+    "gitRefDefault": "远程默认",
+    "gitRefBranches": "分支机构",
+    "gitRefTags": "标签",
+    "gitRefOther": "其他参考…",
+    "gitRefCustom": "提交或参考",
+    "gitRefsNeedUrl": "首先输入一个网址。",
+    "gitRefsNeedAuth": "保存令牌或部署密钥，然后加载分支。",
+    "gitRefsHint": "从远程加载。选择一个 — 不要打字。",
+    "gitHookSetupToggle": "这个怎么粘贴",
+    "gitHookOneLiner": "HMAC 或 X-YSK-Git-Hook。仅此项目的参考。",
+    "gitHookExecuteHint": "需要 YSK_EXECUTE=1 才能克隆或部署。",
+    "gitShowKey": "显示密钥",
+    "gitHideKey": "隐藏",
+    "gitBehindShort": "↓{{计数}}",
+    "gitAheadShort": "↑{{计数}}",
+    "gitDirtyShort": "肮脏 · {{count}}",
+    "gitFilesLink": "文件",
+    "gitTokenLaterHint": "HTTPS 令牌和克隆深度在创建后在项目“部署”选项卡上设置。",
+    "netForceHttpsOn": "发布边缘后，HTTP 将重定向到 HTTPS。",
+    "netForceHttpsOff": "不存储强制重定向。",
+    "netHttpsLiveNotForced": "存在边缘文件； HTTPS 可能已经可以工作。此框仅强制 HTTP→HTTPS。",
+    "gitSyncBlockedDirty": "同步将被禁用，直到本地更改被丢弃（重置）或文件与 Git 匹配为止。",
+    "gitViewDiff": "查看差异",
+    "gitBranchAfterUrl": "请先填写 Git 网址。留空则使用远端默认分支。",
+    "gitResetNeedConfirm": "需确认 — 会丢弃本机提交",
+    "openUrlNeedDomain": "首先设置一个域名 - 不要在浏览器中打开 127.0.0.1",
+    "needOsUser": "首先在“隔离”选项卡上创建系统用户",
+    "stopTitle": "停止该项目（systemd 单元和公共站点）",
+    "deployTitle": "部署此项目",
+    "httpStatsHint": "来自该项目的访问日志（最后一个示例）",
+    "httpStatsNone": "尚无项目访问日志",
+    "statStoppedOnly": "已停止",
+    "statReadyOnly": "准备好",
+    "netBoundCert": "已绑定证书",
+    "netBoundCertExpiry": "到期 {{at}}",
+    "netNoBoundCert": "此主机名磁盘上没有证书",
+    "netForceHttpsNeedCert": "强制 HTTPS 前，请先在 /ssl 为此域名签发证书。",
+    "goIsolation": "Open Isolation tab",
+    "netHstsNeedHttps": "Turn on force HTTPS first",
+    "homeMissing": "Home directory does not exist",
+    "homeMissingHint": "Same live probe as migrate inventory — create the system user on Isolation"
   },
   "protection": {
     "levels": {
@@ -8641,7 +9759,9 @@
     "note": {
       "notApplied": "未套用到系统（需 root + YSK_EXECUTE=1）— 已记到管理设置",
       "nginxWritten": "已写入 Nginx 限速管理檔",
-      "f2bWritten": "已写入 fail2ban 管理設定"
+      "f2bWritten": "已写入 fail2ban 管理設定",
+      "hintDropped": "Internal protection hint omitted",
+      "nginxLimits": "Will write Nginx rate-limit snippet"
     },
     "rel": {
       "justNow": "刚刚",
@@ -8955,7 +10075,67 @@
     "plusRegion": "+ 省 {{v}}",
     "plusCity": "+ 城市 {{v}}",
     "lastTickPrefix": "· 上次 {{t}}",
-    "nextTickPrefix": "· 下轮 {{t}}"
+    "nextTickPrefix": "· 下轮 {{t}}",
+    "stackApply": "套用防護組合（UFW、fail2ban、建議檔）",
+    "stackApplyDone": "已要求套用防護組合",
+    "stackApplyHint": "會啟用 UFW 並套用 fail2ban 與建議防護檔。遠端面板請先確認不會把自己鎖在外面。",
+    "cannotBanSelf": "不可封锁 {{ip}} — 这是本机、你的登录 IP 或 ignoreip",
+    "selfIp": "本主机",
+    "selfHostIp": "主机IP",
+    "selfLoginIp": "您的登录IP",
+    "showZeroScore": "显示 0 分",
+    "hideZeroScore": "隐藏 0 分",
+    "freshnessNa": "不适用",
+    "geoDraftOnly": "政策未启用 — 保存只写草稿，Nginx 不会执行，直到你勾选启用。",
+    "selectAllCountriesWarn": "封锁名单模式下全选全部国家？这可能把本机与你的登录所在地一并封锁。",
+    "badgeRecommendPreset": "以目前威胁水平，建议改用更强预设",
+    "badgeAutomationOn": "自动化已开启",
+    "badgeBanCount": "目前封锁数",
+    "badgeGeoOn": "Geo 准入政策已启用",
+    "badgeGeoNotReady": "GeoIP 数据库尚未就绪",
+    "badgeIntelSignals": "目前计分的信号数",
+    "signalActive": "运行中",
+    "signalInactive": "未启用",
+    "signalJails": "{{n}} 个 jail",
+    "dbReadyHint": "已有 MMDB 文件",
+    "dbNotReadyHint": "请先下载 GeoIP 数据库",
+    "staleHint": "上次成功更新是否已超过 7 日",
+    "statSuspects": "可疑IP",
+    "scoreBasisHint": "威胁评分使用防火墙、fail2ban 禁止量和请求率信号——与英特尔嫌疑人列表的计数不同。",
+    "geoNeedDb": "GeoIP 数据库丢失 - 首先更新 MMDB 文件",
+    "colHits": "次数",
+    "col429": "429",
+    "topIpsTitle": "热点 IP",
+    "hitsCount": "{{n}} 次",
+    "sampleWindowHint": "计数来自当前 access 与 auth 样本窗口，不是完整日志文件。",
+    "statSuspectsSplit": "{{actionable}} actionable / {{total}} listed",
+    "suspectActionableCount": "Actionable IPs {{count}}",
+    "uaNeedZones": "Set a Cloudflare zone first",
+    "banConfirmTitle": "Ban {{ip}}?",
+    "banConfirmDesc": "This IP will be blocked on the host. Confirm it is not a current panel or session address.",
+    "ufwOff": "UFW (off)",
+    "ufwOffHint": "UFW is not active — fail2ban is the usable target.",
+    "whitelistSyncHint": "{{n}} panel entries · fail2ban ignoreip sync: {{sync}}",
+    "whitelistSyncOn": "on",
+    "whitelistSyncOff": "off (lists may differ)",
+    "draftBadge": "Draft",
+    "banIsSelf": "This IP matches the current panel source or this host.",
+    "banNotSelf": "This IP is not the current panel source.",
+    "geoSourceLocal": "Local GeoIP library (sapics + DB-IP)",
+    "nginxPreviewHint": "Nginx snippet this preset would write (preview only):",
+    "modeValue": {
+      "normal": "Normal",
+      "degraded": "Degraded",
+      "ddos-protection": "DDoS protection",
+      "offline": "Offline"
+    },
+    "wlRemovedUndo": "Removed {{ip}} from the allow list. Undo within 5 seconds.",
+    "undo": "Undo",
+    "banSelectedConfirmTitle": "Ban {{count}} selected IPs?",
+    "banSelectedConfirmDesc": "These addresses will be blocked on the host: {{ips}}",
+    "freshnessMissing": "No database",
+    "freshnessStale": "Stale",
+    "freshnessFresh": "Current"
   },
   "publicFiles": {
     "notSet": "未设置",
@@ -8987,7 +10167,20 @@
     "diskRoot": "磁盘根目录",
     "filesInRoot": "条目数",
     "managedConf": "管理 conf",
-    "systemConf": "系统 conf.d"
+    "systemConf": "系统 conf.d",
+    "notes": {
+      "noManagedConf": "尚无托管 Nginx 配置 — 单击“应用”",
+      "notSynced": "托管conf存在，但不在/etc/nginx/conf.d下——使用YSK_EXECUTE再次以root身份申请"
+    },
+    "autoindex": "目录列表（autoindex）",
+    "liveSystemConf": "现行系统配置：{{path}}",
+    "publicRootNote": "公开根目录：{{path}}",
+    "applyConfirmTitle": "套用公开文件站点？",
+    "applyConfirmDesc": "写入 Nginx server_name {{name}} 并重载 Nginx。",
+    "serverNameMismatch": "现行配置为 {{live}}；表单为 {{draft}}。套用后会覆盖。",
+    "executeFlag": "Execute",
+    "asRoot": "Root",
+    "statusDraft": "Draft / not applied"
   },
   "rbac": {
     "permissions": "权限",
@@ -9071,7 +10264,13 @@
       "auditExport": "审计导出",
       "securityApiKeysAdmin": "API 密钥管理",
       "networkBrowse": "主機代瀏覽",
-      "networkVnc": "VNC 远程桌面管理"
+      "networkVnc": "VNC 远程桌面管理",
+      "validatorsRead": "验证者节点（读取）",
+      "validatorsManage": "验证者节点管理",
+      "validatorsWipe": "验证者节点清空数据",
+      "dockerRead": "Docker（读取）",
+      "dockerManage": "Docker 管理",
+      "dockerWipe": "Docker 删除／清理"
     },
     "aboutRoles": "角色说明（出厂默认）",
     "aboutRolesBody": "角色决定默认权限；用户可再覆盖个别能力。",
@@ -9087,7 +10286,14 @@
     "capabilitiesHint": "勾选此角色可用的功能。橙点表示与系统默认不同。",
     "enabledCount": "已开 {{enabled}}／{{total}}",
     "bandAboveMax": "高于最高等级",
-    "dirtyHint": "已自定义（与系统默认不同）"
+    "dirtyHint": "已自定义（与系统默认不同）",
+    "unsaved": "未储存",
+    "unsavedHint": "此角色有未储存变更",
+    "nothingToSave": "没有要储存的变更",
+    "saveRole": "储存「{{role}}」政策",
+    "discardTitle": "放弃未储存政策？",
+    "discardDesc": "转到另一个角色会丢弃未储存的权限变更。",
+    "roleUnavailable": "Not available for this role"
   },
   "readiness": {
     "cat": {
@@ -9095,7 +10301,7 @@
       "security": "权限与安全",
       "binaries": "系统软件",
       "hosting": "运行环境",
-      "dns": "DNS",
+      "dns": "域名系统",
       "email": "邮件",
       "isolation": "项目隔离",
       "ops": "运维"
@@ -9198,7 +10404,38 @@
     "fixNow": "立即修复",
     "fixFailed": "修复失败",
     "fixDone": "已修复 dataDir 权限（chmod 750）",
-    "fixDoneWebUi": "已构建／安装 Web 界面"
+    "fixDoneWebUi": "已构建／安装 Web 界面",
+    "rootLabel": "超级用户",
+    "exportStarted": "正在下載 {{name}}",
+    "blockersHint": "「阻挡」是「缺少」中的关键项，不是额外检查。",
+    "techDetails": "技术细节",
+    "missingOwner": "未分配面板所有者（包配额归属）",
+    "notOsProvisioned": "操作系统用户/主目录尚未配置",
+    "ondrejNone": "未检测到 ondrej Launchpad PHP 源",
+    "ondrejFound": "发现旧版 ondrej/php 源与packages.sury.org 冲突：{{paths}}",
+    "ondrejTitle": "PHP apt源（ondrej残差）",
+    "systemctlActive": "服务正在运行",
+    "systemctlStatus": "服务状态：{{status}}",
+    "binInPath": "路径中的 {{bin}}",
+    "leftoverApache": "Apache 剩余的默认站点",
+    "leftoverVsftpd": "vsftpd 单元失败",
+    "leftoverCli": "过时的剩余 CLI",
+    "leftoverNginx": "Nginx 包罗万象缺失",
+    "leftoverDovecot": "Dovecot TLS 指出缺少证书",
+    "leftoverOther": "主机剩余物",
+    "leftoverApply": "剩余的适用",
+    "isolationOwnerDegrades": "缺少owner_user_id会影响程序包配额属性 - 状态已降级，未就绪。",
+    "totalChecks": "All checks",
+    "totalChecksHint": "Ready + degraded + missing = this total. Blockers are the critical missing subset.",
+    "requireAdminTotp": "require admin 2FA policy",
+    "listenBind": "listen address",
+    "item": {
+      "admin2fa": "Admin two-factor"
+    },
+    "dataDirPerms": "panel data-directory permissions",
+    "mode750": "mode 750",
+    "gateBlocked": "Not passed · {{n}} missing",
+    "isolationPendingOs": "Same as project status: OS user pending. Open Isolation to provision the system user and home."
   },
   "redis": {
     "neverExpire": "永不过期",
@@ -9266,7 +10503,25 @@
     "pickKey": "从左側选擇一个鍵，即可查看内容。",
     "ttlPrefix": "过期：{{ttl}}",
     "writeLiveHint": "此操作直接写入执行中的 Redis，无法从面板一鍵还原。",
-    "refPath": "参考：{{path}}"
+    "refPath": "参考：{{path}}",
+    "dbEmptyMark": " · 空",
+    "noRequirepass": "保护模式已开，但 requirepass 为空或未读到 — 实际无密码。",
+    "setRequirepass": "设定密码",
+    "rdbOnlyLossHint": "AOF 关闭且 RDB 开启。重启或崩溃可能丢失最近写入。",
+    "dirDataContainer": "/data (container)",
+    "dirHostDefault": "/var/lib/redis",
+    "dirDefaultInstance": "/var/lib/redis/default",
+    "dirDataWarn": "/data is usually a container path; this panel cannot confirm it exists.",
+    "saveOff": "禁用快照（不推荐）",
+    "saveOffWarn": "空保存字符串会关闭 RDB 快照。如果 AOF 也关闭，则崩溃可能会丢失所有数据。",
+    "dirMoveWarn": "更改目录不会移动 dump.rdb / AOF。下次启动将按原样使用新路径。",
+    "passwordUnset": "未在服务上设置",
+    "passwordSetHidden": "设置（未显示）",
+    "scanHint": "Uses SCAN, not KEYS. Returns at most {{n}} keys — avoid * on huge databases.",
+    "scanCapped": "Showing the first {{n}} matches.",
+    "dbOptionKeys": "DB {{i}} · {{n}} keys",
+    "dbOptionEmpty": "DB {{i}} · empty",
+    "insecureShort": "No password"
   },
   "resources": {
     "created": "已创建",
@@ -9639,7 +10894,7 @@
         "errorLogDefault": "系统默认（空）",
         "errorLogPhp": "/var/log/php/error.log",
         "errorLogFpm": "FPM 日志路径",
-        "errorLogSyslog": "syslog"
+        "errorLogSyslog": "系统日志"
       },
       "disableFn": {
         "groups": {
@@ -9734,7 +10989,29 @@
       "projectsCount": "YSK 项目数",
       "noProjects": "没有项目",
       "noProjectsDesc": "面板没有 node/bun 项目，或未建 OS 用户。",
-      "pm2OnlyDesc": "仅显示 panel 用户用 PM2 启动的进程。systemd 部署见上方项目表。"
+      "pm2OnlyDesc": "仅显示 panel 用户用 PM2 启动的进程。systemd 部署见上方项目表。",
+      "startupTitle": "开机启动",
+      "startupDesc": "注册 PM2，以便进程在重新启动后恢复。",
+      "systemdActionsHint": "systemd 操作需要 root 和 YSK_EXECUTE。",
+      "startupOk": "已登记开机启动。{{notes}}",
+      "startupFail": "无法登记开机启动。{{notes}}",
+      "actionOk": "{{action}} {{name}} — {{notes}}",
+      "actionFail": "无法 {{action}} {{name}}。{{notes}}",
+      "startupReady": "就绪",
+      "startupReadyYes": "是",
+      "startupReadyNo": "否",
+      "startupUnit": "单元",
+      "startupDump": "转储",
+      "startupInstall": "安装开机启动",
+      "startupSave": "保存进程列表",
+      "actRestart": "重启",
+      "actStop": "停止",
+      "actReload": "重新加载",
+      "pm2ActionsHint": "PM2 操作只作用于面板用户的进程列表。",
+      "noteUnparsed": "PM2 list could not be parsed (empty or unexpected output).",
+      "notePanelUserOnly": "PM2 list is for the panel process user only.",
+      "noteProjectUnits": "{{n}} YSK project unit(s) listed",
+      "glossary": "PM2 = process manager; SSE = live stream."
     },
     "recordedInstalled": "记录已装 {{v}}",
     "remoteSourceSuffix": "（{{source}}）",
@@ -9788,7 +11065,32 @@
     "path": "路径",
     "fullVersion": "完整版本",
     "useListForDefaults": "要改主机／面板默认或移除此版本，请用上方列表。",
-    "alreadyHostDefaultShort": "主机默认"
+    "alreadyHostDefaultShort": "主机默认",
+    "managedPathMissingTitle": "受管 {{name}} 路徑未就緒",
+    "managedPathMissing": "版本 {{version}} 的 YSK 受管 {{name}} 尚未就緒。請重新探測或重新安裝。",
+    "installRecordedCta": "前往软件分页安装 {{v}}",
+    "targetMissing": "目标版本未安装",
+    "targetMissingHint": "目标 {{version}} 不在本机。请改绑已安装的版本，或先安装此版本。",
+    "needsInstall": "需安装",
+    "needsInstallHint": "此版本未在本机。请先安装，或改选已安装的版本。",
+    "unitBytes": "字节",
+    "headerSizeKb": "{{n}} KB",
+    "phpIniChipEmpty": "未载入 — 请打开 php.ini 分页",
+    "phpFpmService": "PHP-FPM",
+    "phpFpmServiceDesc": "启动、停止、重载或重启 PHP-FPM 单元",
+    "rustupDefaultMissingTitle": "未设 rustup 默认工具链",
+    "rustupDefaultMissing": "rustup 未设默认工具链。请到「软件」分页设为 stable。",
+    "rustupDefaultMissingShort": "没有默认工具链",
+    "rustupSetDefaultHint": "设置默认工具链",
+    "uninstalledCountHint": "{{n}} 个版本未在本机",
+    "applyPhpVhostTitle": "需要确认 - 写入池/虚拟主机文件",
+    "applyPhpVhostDesc": "将写入 {{pool}} 池和 {{domain}} 虚拟主机。重新加载服务：{{reload}}。",
+    "binaryPath": "二进制路径",
+    "installedLabel": "Installed",
+    "installedHint": "Host probe result — not the control-plane record",
+    "targetHint": "Version this page will install or pin",
+    "rebuildFromHost": "Rebuild record from host",
+    "rebuiltFromHost": "Record refreshed from host probe"
   },
   "search": {
     "placeholder": "搜索页面与资源…",
@@ -9802,7 +11104,7 @@
       "email": "邮件",
       "mailbox": "邮箱",
       "ssl": "SSL",
-      "dns": "DNS",
+      "dns": "域名系统",
       "nginx": "Nginx",
       "share": "分享",
       "ftp": "FTP",
@@ -9812,6 +11114,10 @@
       "cron": "Cron",
       "user": "用户",
       "other": "其他"
+    },
+    "alias": {
+      "ssl": "证书 cert certificate certs",
+      "projects": "项目 专案 project sites"
     }
   },
   "security": {
@@ -9835,7 +11141,7 @@
     "tabApiKeys": "API 密钥",
     "tabSsh": "SSH",
     "tabApprovals": "审批",
-    "tabAllowlist": "允许清单",
+    "tabAllowlist": "工具权限",
     "apiTokenOnce": "API token（只显示一次）：",
     "copiedToken": "已复制 token",
     "totpTitle": "双重验证 (TOTP)",
@@ -9919,8 +11225,8 @@
     "revokeAllDevices": "撤销全部设备",
     "revokedAllDevices": "已撤销全部信任设备",
     "export2faBackup": "导出 2FA 加密备份",
-    "fail2banSnippetMsg": "Fail2ban 片段：{{written}} — {{notes}}",
-    "generateFail2ban": "生成 Fail2ban 片段",
+    "fail2banSnippetMsg": "fail2ban 片段：{{written}} — {{notes}}",
+    "generatefail2ban": "生成 fail2ban 片段",
     "adminPolicyTitle": "管理员 2FA 政策",
     "adminPolicyDesc": "",
     "requireAdmin2fa": "要求管理员启用 2FA",
@@ -9940,8 +11246,9 @@
     "apiKeysEmpty": "尚未有 API 密钥",
     "apiKeysEmptyHint": "用列表右上角创建；创建后可用 Bearer token 调用 API",
     "approve": "批准",
-    "allowlistTitle": "允许列表（{{count}}）",
-    "allowlistEmpty": "尚无 allowlist 工具",
+    "allowlistTitle": "工具权限（{{count}}）",
+    "allowlistEmpty": "尚无工具目录项目",
+    "totpStatusLoadFailed": "无法载入双重验证状态",
     "createApiKeyTitle": "创建 API 密钥",
     "createApiKeyDesc": "创建后完整 token 只显示一次",
     "createKeyBtn": "创建密钥",
@@ -10183,7 +11490,23 @@
       "sharePanelTitle": "共用 panel TOTP secret？",
       "sharePanelDesc": "风险高。请输入 SHARED 确认。",
       "confirmString": "确认字符串",
-      "enableShare": "启用共用"
+      "enableShare": "启用共用",
+      "invalidPub": "请贴上完整 OpenSSH 公钥行（ssh-ed25519／ssh-rsa／ecdsa…）。",
+      "dryRunOk": "预览试行完成。请查看下方预览。",
+      "strictDryRun": "严格模式预览",
+      "errorNoDetail": "测试失败（无详情）",
+      "strictBlocked": "套件或 PAM 未就绪，已停用套用 Strict。",
+      "privCloseWithoutAck": "已关闭。私钥不会再显示；若尚未保存，请立即重新生成。",
+      "loginNoProjects": "没有项目。在下面授权现有的 Linux 用户（root / tester）。写入/root/.ssh需要YSK_EXECUTE=1。",
+      "loginLinuxHint": "没有项目时使用。示例：root 或 tester。",
+      "pkgStatus": "Package {{status}}",
+      "pamStatus": "PAM {{status}}",
+      "kbdStatus": "sshd keyboard-interactive {{status}}",
+      "light": {
+        "green": "ok",
+        "yellow": "check",
+        "red": "missing"
+      }
     },
     "sessionsActive": "使用中",
     "sessionsOther": "其他设备",
@@ -10206,7 +11529,49 @@
     "revokeOthersDesc": "将结束 {{count}} 个其他会话。当前浏览器保持登录。",
     "sessionRevoked": "已登出该会话",
     "mySecurityHint": "",
-    "policyTotpHint": "全站政策：要求 admin 角色各自启用 2FA（每人自己扫码），不是共用同一组验证码。"
+    "policyTotpHint": "全站政策：要求 admin 角色各自启用 2FA（每人自己扫码），不是共用同一组验证码。",
+    "requireUser2fa": "要求所有面板用户启用 2FA",
+    "generateFail2ban": "产生 fail2ban 片段",
+    "changePasswordTitle": "变更登录密码",
+    "currentPassword": "目前密码",
+    "newPassword": "新密码",
+    "confirmNewPassword": "确认新密码",
+    "passwordMismatch": "两次新密码不一致。",
+    "changePassword": "变更密码",
+    "passwordChanged": "已更新密码。",
+    "strictNeedsEnrolled": "至少一名管理员已开 2FA，才可开启 Strict。",
+    "policyTotpNeedSelf": "请先在本帐号启用 2FA，否则确认码无法填写。",
+    "fail2banSnippetTitle": "fail2ban 片段",
+    "fail2banSnippetEmpty": "没有写入片段。",
+    "trustedDevicesTitle": "信任装置",
+    "noTrustedDevices": "尚未有信任装置。",
+    "strictConfirmTitle": "开启 Strict 2FA？",
+    "strictConfirmDesc": "未开 2FA 的用户会被拒绝登录。请确认你已有可用的 TOTP 或通行密钥。",
+    "revokeDevicesTitle": "撤销信任装置？",
+    "revokeDevicesDesc": "已记住的浏览器要再做 2FA。",
+    "approvalsHint": "高风险工具需要第二人批准时会出现在此。权限在「用户 → 权限」设定。",
+    "allowlistReadonly": "代理工具目录（只读）。能力授权在「用户 → 权限」设定。",
+    "colTool": "工具",
+    "colAllowed": "允许",
+    "colRisk": "风险",
+    "colApproval": "审批",
+    "risk": {
+      "low": "低",
+      "medium": "中",
+      "high": "高",
+      "critical": "严重"
+    },
+    "confirmDeleteApiKey": "删除此 API 密钥？",
+    "confirmDeleteApiKeyDesc": "删除后「{{name}}」无法再验证。此操作无法复原。",
+    "policyNoTotpHint": "This account has no 2FA yet — saving policy does not need a TOTP. Set up 2FA above if you want to require it for others.",
+    "sessionCli": "CLI",
+    "sessionApi": "API",
+    "statApiSessions": "API 会话",
+    "revokeOtherTitle": "退出 {{n}} 个其他会话",
+    "policyNeedSelf2fa": "首先在此帐户上启用 2FA，然后使用 TOTP 代码进行确认",
+    "revokeAllDevicesTitle": "撤销每个记住的设备 - 您和其他管理员必须再次验证 2FA",
+    "statSshValue": "{{keys}} keys · {{auth}} authorized",
+    "statSshHint": "Outbound identities / authorized login keys"
   },
   "serviceExposure": {
     "title": "网络访问",
@@ -10237,7 +11602,19 @@
     "restrictedNeedSource": "受限模式请至少加入 IP／网段或国家代码。",
     "privateStartTitle": "要对外开放 {{service}} 吗？",
     "confirmAndStart": "确认并启动",
-    "cloudSgNote": "仅主机防火墙 — 不会改云安全组（AWS／GCP／Azure）。"
+    "cloudSgNote": "仅主机防火墙 — 不会改云安全组（AWS／GCP／Azure）。",
+    "serviceNotInstalled": "此服務尚未安裝，防火牆規則不會生效。",
+    "modeUndecided": "尚未設定",
+    "modeLoading": "載入中",
+    "summaryUndecided": "尚未確認存取模式（目錄建議：{{suggested}}）。",
+    "summaryNotEnforced": "防火牆未啟用，面板未強制開放或封鎖此埠。",
+    "roleSmtp": "SMTP 提交",
+    "roleImap": "IMAP／POP3 收件",
+    "openButStopped": "端口打开 — 服务未运行",
+    "openNoTenants": "没有租户的公共港口",
+    "summaryFirewallOffOnly": "Host firewall is not enabled, so port rules are not enforced.",
+    "modePublicLive": "Public (live bind)",
+    "summaryPublicLive": "Listening on {{bind}} — reachable on all interfaces. Confirm access mode; this is not private."
   },
   "services": {
     "enabledBoot": "自启",
@@ -10245,8 +11622,30 @@
       "start": "启动",
       "stop": "停止",
       "restart": "重启",
-      "reload": "重载"
-    },
+      "reload": "重载",
+      "enable": "开机启用",
+      "disable": "取消开机启用"
+    },
+    "lifecycleTitle": "{{label}} 服務控制",
+    "startedOk": "已啟動 {{label}}",
+    "stoppedOk": "已停止 {{label}}",
+    "restartedOk": "已重啟 {{label}}",
+    "reloadedOk": "已重載 {{label}}",
+    "stopConfirmTitle": "停止 {{label}}？",
+    "stopConfirmDesc": "{{label}} 將停止接聽。需要時可在本頁再啟動。",
+    "stopConfirmEdgeDesc": "停止 {{label}} 會令站點與反向代理離線，直至再次啟動。",
+    "stopConfirmEdgeConsequence": "{{label}} 停止期間，本機不會提供 HTTP／HTTPS。",
+    "stopConfirmSshdTitle": "停止 sshd？",
+    "stopConfirmSshdDesc": "停止 sshd 會中斷遠端 SSH。請確認你仍有主機控制台或其他登入途徑。",
+    "stopConfirmSshdToken": "停止 sshd",
+    "stopConfirmSshdConsequence": "新的 SSH 連線會失敗，直至在主機控制台再啟動 sshd。",
+    "stopConfirmPanelTitle": "停止 YSK Server？",
+    "stopConfirmPanelDesc": "面板與 API 會離線，直至在主機上再啟動該服務單元。",
+    "stopConfirmPanelToken": "停止 ysk 服务器",
+    "stopConfirmPanelConsequence": "此瀏覽器工作階段會中斷。請從 SSH 或主機控制台啟動服務單元。",
+    "stopConfirmFail2banTitle": "停止 fail2ban？",
+    "stopConfirmFail2banDesc": "停止 fail2ban 後不會再自動封鎖 IP。網站與 SSH 會繼續運作。",
+    "stopConfirmFail2banConsequence": "在再次啟動 fail2ban 之前，新的攻擊來源不會被自動封鎖。",
     "actionDone": "已{{action}}",
     "runningOf": "{{running}}/{{total}} 运行中",
     "canMutate": "可变更",
@@ -10272,12 +11671,48 @@
     "bootPrefix": "开机 {{state}}",
     "controlPage": "控制页",
     "manageRuntime": "安装／更新",
+    "installOrOpen": "安裝／開啟",
     "protectionTitle": "保护探测",
     "protectionSub": "只读；不改防火墙／fail2ban",
     "protectionDoneNote": "保护探测完成",
     "probeDone": "探测完成",
     "runProtection": "执行保护探测",
-    "notProbedYet": "尚未探测"
+    "notProbedYet": "尚未探测",
+    "statusFilter": {
+      "all": "所有州",
+      "running": "跑步",
+      "failed": "失败的",
+      "missing": "未安装"
+    },
+    "stopNeedConfirm": "需确认",
+    "stopNeedConfirmPhrase": "需输入确认短语",
+    "enabledOk": "已设置 {{label}} 开机启动",
+    "bootDisabledWarn": "{{label}} 正在运行，但重启后不会自动启动。请启用开机启动。",
+    "bootDisabledShort": "未开机启动",
+    "mariadbNotInstalled": "尚未安装 MariaDB",
+    "mariadbNotInstalledMysqlOk": "Not installed: MariaDB (MySQL is installed)",
+    "restartConfirmPanelTitle": "Restart YSK Server?",
+    "restartConfirmPanelDesc": "The panel and API will drop briefly while the unit restarts.",
+    "unitNotFound": "Unit not installed",
+    "unitNa": "Not applicable",
+    "unitStatic": "static",
+    "unitIndirect": "indirect",
+    "needRunning": "{{label}} is not running",
+    "bootNa": "Not applicable",
+    "permLabel": "Permission",
+    "permCanChange": "Can change the system (superuser)",
+    "permBlocked": "Cannot change the system",
+    "permHint": "System change {{exec}} · Superuser {{root}}",
+    "clusterLegend": "Planned = saved in the panel, not applied on the host.",
+    "active": {
+      "active": "Running",
+      "inactive": "Stopped",
+      "not-found": "Not installed",
+      "failed": "Failed",
+      "tool": "Tool",
+      "activating": "Starting"
+    },
+    "sshdBootOffWarn": "sshd is not enabled on boot. After reboot this host will have no SSH rescue path."
   },
   "software": {
     "title": "软件中心",
@@ -10368,7 +11803,8 @@
       "pick": "选择版本",
       "noTarget": "没有可更新版本",
       "needRuntimePage": "请在运行环境页安装此版本",
-      "noAptCandidate": "没有可用的 apt 候选版本"
+      "noAptCandidate": "没有可用的 apt 候选版本",
+      "sourceLabel": "来源"
     },
     "install": {
       "progress": "正在安装：{{list}}…",
@@ -10467,14 +11903,24 @@
       "generic": "相關服务可能停止",
       "purgeData": "将删除資料路径",
       "protectedSkipped": "受保护元件會跳过",
-      "runtimeStack": "将移除此运行时面板管理的全部版本"
+      "runtimeStack": "将移除此运行时面板管理的全部版本",
+      "containers": "正在运行的容器将停止",
+      "validators": "使用 Docker Compose 的验证者节点堆栈将停止"
     },
     "requestCancel": "请求取消",
     "cancelling": "取消中…",
     "dockCancelling": "取消中 · {{title}}",
     "dockCancelled": "已取消 · {{title}}",
     "cancelHint": "已请求取消。浏览器已停止接收日志；主机可能仍会完成当前的 apt／步骤。请稍后重新探测状态。",
-    "cancelledToast": "已取消操作（客户端已停止串流）"
+    "cancelledToast": "已取消操作（客户端已停止串流）",
+    "kindApply": "套用",
+    "kindScan": "扫描",
+    "kindDeploy": "部署",
+    "kindRuntime": "运行时",
+    "jobDone": "完成 · {{title}}",
+    "jobFailed": "失败 · {{title}}",
+    "uninstallUfwWarn": "卸载 UFW 后，主机将失去面板管理的端口防火墙。",
+    "uninstallFail2banWarn": "卸载 fail2ban 会停止 jail 并解除现有封锁。若要保留服务，请先把登录 IP 加入 ignoreip。"
   },
   "sqlEngineHealth": {
     "finding": {
@@ -10690,7 +12136,18 @@
     "requestDone": "证书申请已完成",
     "requestFailed": "证书申请未成功",
     "applyFailed": "申请失败",
-    "deletedCert": "已删除 {{domain}}"
+    "deletedCert": "已删除 {{domain}}",
+    "uninstallCertbotWarn": "解除安装 certbot 会使现有 Let's Encrypt 证书无法自动续期。",
+    "renew": "更新",
+    "renewFor": "为 {{domain}} 续订 Let's Encrypt",
+    "domainRequired": "请填写域名。",
+    "domainInvalid": "域名格式无效。",
+    "domainKnownHint": "可从已知项目、DNS 或邮件域名选择，或自行输入。",
+    "deleteNeedDomain": "删除此证书 — 输入域名进行确认",
+    "panelCertHint": "Panel HTTPS uses {{path}} (expires {{exp}}). It is not listed as a site certificate.",
+    "openPanelTls": "Open panel HTTPS",
+    "deleteDomain": "Delete {{domain}}",
+    "uninstallCertbot": "Uninstall certbot (loses auto-renew)"
   },
   "stackWizard": {
     "purgeConfirm": "确认清除？将删除已登记的数据目录（数据库／邮件等），此操作无法复原。",
@@ -10705,16 +12162,23 @@
     "componentsTitle": "将安装的组件",
     "dryRun": "预览试行",
     "installNow": "立即安装",
-    "uninstallHint": "勾选要移除的套餐；若全部不勾选，则移除清单内全部组件。默认保留数据。",
+    "uninstallHint": "勾选要移除的套餐。未勾选时无法移除。默认保留数据。",
     "dataPolicy": "数据策略",
     "keepData": "保留数据",
     "purgeData": "清除数据",
-    "uninstallNow": "立即移除"
+    "uninstallNow": "立即移除",
+    "uninstallNeedSelect": "至少选择一个捆绑包。空选择不再意味着全部删除。",
+    "uninstallConfirmTitle": "删除选定的捆绑包？",
+    "uninstallConfirmDesc": "{{count}} 个捆绑包将被删除。键入 REMOVE 进行确认。",
+    "countHint": "These counts are OS packages in the software plan — not the service-matrix units on the other tab.",
+    "executeRoot": "System changes {{execute}} · administrator {{root}}",
+    "manifestPlan": "Plan {{plan}} ({{bundles}})",
+    "manifestHint": "Last chosen software plan and bundles"
   },
   "support": {
     "title": "支持",
     "sub": "Creator、赞助与 YSK Limited — 免费产品，实在支持",
-    "creatorTitle": "Creator",
+    "creatorTitle": "创作者",
     "creatorBody": "YSK Server 是免费、诚实的单机控制平面，给想自己掌控服务器的人。项目开源维护；你的反馈和 bug 报告很重要。",
     "donateTitle": "支持／赞助",
     "donateBody": "如果 YSK Server 帮你省时间，欢迎赞助开发。每一份支持都帮产品继续免费给所有人用。",
@@ -10737,7 +12201,23 @@
     "cryptoNetwork": "网络",
     "cryptoAddress": "地址",
     "copy": "复制",
-    "copied": "已复制"
+    "copied": "已复制",
+    "docsLink": "说明文件",
+    "diagTitle": "诊断总结",
+    "diagBody": "复制版本、执行并托管事实以粘贴到电子邮件中。这不是完整的日志包。",
+    "diagCopy": "复制诊断摘要",
+    "diagCopied": "已复制诊断摘要",
+    "copyTitle": "复制 {{address}}",
+    "diagCopyTitle": "复制版本、EXECUTE 与主机资料",
+    "diagPreview": "预览将复制的内容",
+    "diagLoading": "正在加载诊断...",
+    "diagLoadFailed": "无法加载诊断",
+    "copiedAddr": "Copied {{addr}}",
+    "diagStatus": "Status",
+    "diagMode": "Mode",
+    "diagProtection": "Protection",
+    "diagHostname": "Hostname",
+    "diagOs": "OS"
   },
   "system": {
     "exportLoadFailed": "加载导出数据失败",
@@ -10770,7 +12250,7 @@
     "timezone": "时区",
     "timezoneHint": "从清单选择时区（例如 Asia/Hong_Kong）",
     "timezoneSelect": "请选择时区",
-    "dns": "DNS",
+    "dns": "域名系统",
     "updated": "已更新",
     "applyIdentity": "套用身份",
     "identitySetHostname": "主机名已设为 {{name}}",
@@ -10818,7 +12298,17 @@
       "leOk": "已取得 {{domain}} 的 Let’s Encrypt 证书",
       "leFailed": "申请证书失败：{{detail}}",
       "leHint": "请确认域名 A 记录指向本机，且 80 端口可从外网到达（或 nginx 已服务该域名）",
-      "openFirewall": "若外网连接：防火墙请允许面板端口 {{port}}/tcp（防火墙 → 开埠 → 9287 Panel）"
+      "openFirewall": "若外网连接：防火墙请允许面板端口 {{port}}/tcp（防火墙 → 开埠 → 9287 Panel）",
+      "disableConfirmTitle": "禁用面板 HTTPS？",
+      "disableConfirmDesc": "该面板将提供 HTTP 服务。 WebAuthn / Passkey 将停止工作，直到 HTTPS 再次打开。",
+      "disablePasskeyWarn": "注册的密钥需要 HTTPS — 它们在 HTTP 上会失败。",
+      "disableNeedConfirm": "需确认 — 请输入 DISABLE-HTTPS",
+      "listenPublic": "小组正在监听公共地址 (0.0.0.0/::)。使用防火墙限制或绑定到 127.0.0.1。",
+      "bootstrapCert": "这是自签名引导证书——浏览器会发出警告。为面板域颁发受信任的证书。",
+      "cliNoSocket": "CLI 没有实时 HTTP 套接字； servingHttps 是从配置和监听套接字 (ss) 推断出来的。",
+      "listenHost": "收听地址",
+      "currentHost": "本次会议",
+      "replaceCert": "替换为受信任的证书"
     },
     "timeNtp": "时间与 NTP",
     "clockStatus": "系统时钟状态",
@@ -10923,7 +12413,21 @@
     "exportPath": "导出路径",
     "mode": "模式",
     "managedConf": "托管配置",
-    "dryRunFlag": "预览试运行"
+    "dryRunFlag": "预览试运行",
+    "timezoneSearch": "筛选时区…",
+    "resyncNtp": "重新同步 NTP",
+    "storageSub": "磁盘用量",
+    "syncReloadNeedConfirm": "需确认 — 会写入 /etc/nginx/conf.d 并重新载入 Nginx",
+    "nginxLeftover": "残留",
+    "nginxUnused": "未使用",
+    "nginxLeftoverHint": "旧 public-files 或其他残留配置。同步仍会一并写入，除非操作员另行处理。",
+    "nginxUnusedHint": "默认／catch-all 配置（000-default）。同步仍会一并写入，除非操作员另行处理。",
+    "powerUnlock": "解锁危险区域",
+    "powerLock": "锁定危险区域",
+    "noScheduledPower": "未安排重新启动或关机",
+    "timezoneNow": "Host time now: {{time}} ({{tz}})",
+    "timezoneBrowserDiff": "This host uses {{host}}; your browser uses {{browser}}. Changing timezone here changes the host clock, not the browser.",
+    "notExported": "Not exported yet"
   },
   "systemd": {
     "enabled": "已启用",
@@ -11017,7 +12521,9 @@
     "aboutPolicySub": "写模板与安装到系统是两步；装完仍可重跑，不代表未完成。",
     "policyInstallFull": "安装并启用：复制到 /etc/systemd/system、daemon-reload、enable --now。需 root + EXECUTE。",
     "policyBlockedTitle": "无权限时封锁",
-    "policyNotEqualTitle": "状态不等同"
+    "policyNotEqualTitle": "状态不等同",
+    "rawStateHint": "Raw unit state in tooltip",
+    "bootHint": "Whether the unit starts at boot"
   },
   "tabs": {
     "scrollLeft": "向左滚动分页",
@@ -11057,7 +12563,15 @@
     "stepUpHint": "账户已启用 2FA 时，root 登录需再验证。",
     "stepUpTitle": "确认 root shell",
     "stepUpDesc": "输入验证器代码或救援码。",
-    "totpLabel": "TOTP／救援码"
+    "totpLabel": "TOTP／救援码",
+    "sessionStillOpen": "说明分页开启期间，工作阶段仍保持连线。",
+    "rootConfirmTitle": "打开 root shell？",
+    "rootConfirmDesc": "此会话是主机上不受限制的 root PTY。命令会写入审计记录。",
+    "rootConfirmBody": "仅在你打算执行具权限的主机命令时继续。",
+    "copyAll": "全部复制",
+    "copyAllNeedConn": "首先连接——断开连接时缓冲区为空",
+    "groupSystem": "System",
+    "groupProject": "Project"
   },
   "uiInline": {
     "s27d9daa5": "已預填 runtime {{v0}} {{v1}}，可建立專案",
@@ -11357,9 +12871,9 @@
     "applyPanelUpdate": "套用面板更新",
     "recheck": "重新检查",
     "aboutScope": "范围",
-    "aboutScopeV": "ysk-server 控制面版本 · 非系统 apt 全量升级",
+    "aboutScopeV": "ysk-server 控制面 + catalog 服務 + runtime + 其餘 apt 套件",
     "aboutChannel": "频道",
-    "aboutChannelV": "npm → GitHub release → package.json；套用：npm install -g 或 git（YSK_SOURCE_ROOT）",
+    "aboutChannelV": "npm 套件 ysk-server → GitHub release → apps/server/package.json；套用：npm i -g ysk-server@版本 或 git（YSK_SOURCE_ROOT）",
     "aboutFail": "失败",
     "aboutFailV": "频道不可用不会假装已是最新；套用需 EXECUTE；git 后需重启服务",
     "jobsTitle": "计划任务",
@@ -11436,7 +12950,79 @@
     "scanNow": "立即扫描",
     "viewUpgradable": "查看可升级",
     "installElsewhere": "安装软件（Nginx、PHP、数据库等）请到对应功能页，而非本页。",
-    "status": "状态"
+    "status": "状态",
+    "groupService": "服务",
+    "groupRuntime": "执行环境",
+    "groupOs": "系统套件",
+    "notInstalled": "未安装",
+    "goToPage": "前往页面",
+    "hubHint": "本机 catalog 服务与 runtime。请扫描以刷新。",
+    "intervalDay": "每日",
+    "intervalDays": "每 {{n}} 日",
+    "intervalHour": "每小时",
+    "intervalHours": "每 {{n}} 小时",
+    "intervalMinutes": "每 {{n}} 分钟",
+    "intervalSeconds": "每 {{n}} 秒",
+    "availableHint": "套件管理有较新候选版本的套件。",
+    "servicesHint": "本机 catalog 服务。未安装请前往该服务页安装。",
+    "runtimeHint": "本机执行环境。升级请到各执行环境页。",
+    "needsReboot": "需重启",
+    "kernelRebootWarn": "安装新 kernel 后通常要重启才会生效。",
+    "neverRun": "尚未执行",
+    "scanOsvN": "扫描 + OSV（前 {{n}} 个）",
+    "rebootNeeded": "重新启动",
+    "kernelRebootHint": "内核包应用后需要重新启动",
+    "needApprovalHint": "打开“可用”并筛选需要批准的软件包",
+    "applyNeedConfirm": "申请前打开确认对话框",
+    "probeFailed": "探测失败",
+    "notViaApt": "不由 apt 管理 — 没有候选人",
+    "noCandidate": "无候选版本",
+    "jobOpenGeo": "地理IP页面",
+    "job": {
+      "protection_probe": {
+        "name": "保护探头",
+        "hint": "周期性防御信号"
+      },
+      "updates_scan": {
+        "name": "更新扫描",
+        "hint": "刷新包裹库存"
+      },
+      "daily_backup": {
+        "name": "每日备份",
+        "hint": "计划备份全部"
+      },
+      "db_temp_expire": {
+        "name": "使临时数据库用户过期",
+        "hint": "删除过期的临时数据库用户"
+      },
+      "defense_auto_ban": {
+        "name": "国防自动禁令",
+        "hint": "应用自动禁止勾选"
+      },
+      "defense_geoip_update": {
+        "name": "地理IP更新",
+        "hint": "下载 GeoIP 数据库"
+      },
+      "log_auto_vacuum": {
+        "name": "原木真空",
+        "hint": "日记保留"
+      },
+      "email_dnsbl": {
+        "name": "电子邮件 DNSBL",
+        "hint": "邮件 DNSBL 检查"
+      },
+      "validators_upgrade_scan": {
+        "name": "Validators upgrade scan",
+        "hint": "Check validator image / binary updates"
+      }
+    },
+    "applyPanelAlreadyLatest": "已经是最新的面板版本了",
+    "panelRestarting": "面板正在重启以加载新版本…",
+    "panelRestarted": "面板已恢复 · {{version}}",
+    "panelRestartWait": "已套用更新。若本页未刷新，请数秒后重新加载。",
+    "cveNotChecked": "Not checked",
+    "cveLabel": "CVE",
+    "riskUnevaluated": "Not evaluated — run Scan + OSV"
   },
   "users": {
     "userCount": "{{count}} 用户",
@@ -11558,7 +13144,291 @@
     "securityClearTotpHint": "需 step-up 验证；清除后该用户下次只需密码登录（直至自行重设 2FA）。",
     "securityClearConfirm": "输入用户名以确认清除 2FA",
     "securityClearOk": "已清除 {{name}} 的 2FA",
-    "securitySelfNote": "要为自己设置 2FA，请到「安全 → 我的安全」。"
+    "securitySelfNote": "要为自己设置 2FA，请到「安全 → 我的安全」。",
+    "cannotDeleteSelf": "不能删除目前登入的帐户",
+    "cannotModifySelf": "不能暂停或降级目前登入的帐户",
+    "cannotDeleteLastAdmin": "不能删除最后一个管理员",
+    "cannotDemoteLastAdmin": "不能暂停或降级最后一个管理员",
+    "lockSelfHint": "这是目前登入的帐户。已禁止删除、暂停及更改角色，以免无法登入。",
+    "lockLastAdminHint": "这是最后一个管理员。已禁止删除、暂停及降级。",
+    "demoteAdminTitle": "降级此管理员？",
+    "demoteAdminDesc": "此用户将失去完整管理员权限。请确认仍有其他管理员。",
+    "searchPkgPh": "方案名稱",
+    "quotaNonNeg": "数量与配额不可为负数。",
+    "diskQuotaHint": "预设晶片以 GiB 计；自订栏为 MiB。",
+    "bandwidthHint": "0 代表不限。",
+    "impersonateHint": "以该用户身份打开会话。使用帐户菜单留下模拟。",
+    "operatorHighRiskHint": "系统默认「操作员」含高危写入（服务控制、防火墙、套件套用、MySQL、发布 Nginx）。收窄只影响新建账户；修改默认会影响现有操作员。",
+    "cannotImpersonateSelf": "您已经以此帐户登录",
+    "singleAdminNo2fa": "该主机有一个管理员，并且 2FA 已关闭 - 启用 2FA 并添加备份管理员。",
+    "enableAdmin2fa": "Enable admin 2FA",
+    "addBackupAdmin": "Add a backup admin"
+  },
+  "validators": {
+    "title": "验证者节点 (Beta)",
+    "subtitle": "在此主机安装与管理 L1 节点。非托管 — 私钥由你自行保管。",
+    "beta": "Beta",
+    "tab": {
+      "nodes": "节点",
+      "disk": "磁盘",
+      "about": "说明"
+    },
+    "empty": {
+      "title": "尚未建立验证者节点",
+      "desc": "用向导几步建立测试网节点。"
+    },
+    "refresh": "刷新",
+    "disk": {
+      "title": "验证者节点磁盘",
+      "root": "数据目录",
+      "free": "可用",
+      "used": "已用",
+      "none": "尚无实例数据",
+      "warn": "磁盘用量偏高（70% 或以上）",
+      "danger": "磁盘用量危急（85% 或以上）",
+      "autoClear": "磁盘危急时自动清空最大的已停止实例（默认关闭）",
+      "autoClearRisk": "Destructive: the largest stopped instance is deleted without a further prompt. Default is off. Check audit / logs after it fires.",
+      "autoClearConfirmTitle": "Enable auto-clear?",
+      "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again."
+    },
+    "chain": {
+      "eth": "Ethereum",
+      "avax": "Avalanche",
+      "near": "NEAR",
+      "ada": "Cardano",
+      "btc": "Bitcoin",
+      "cosmos": "Cosmos Hub",
+      "sui": "Sui",
+      "aptos": "Aptos",
+      "dot": "Polkadot",
+      "sol": "Solana"
+    },
+    "network": {
+      "hoodi": "Hoodi",
+      "sepolia": "Sepolia",
+      "mainnet": "主网",
+      "fuji": "Fuji",
+      "testnet": "测试网",
+      "preview": "预览",
+      "preprod": "预生产",
+      "westend": "Westend"
+    },
+    "networkKind": {
+      "testnet": "测试网",
+      "mainnet": "主网",
+      "mixed": "Mainnet + testnet"
+    },
+    "profile": {
+      "minimal": "精简",
+      "pruned": "Pruned",
+      "validator-ready": "验证者就绪",
+      "rpc": "RPC"
+    },
+    "col": {
+      "id": "标识",
+      "chain": "链",
+      "network": "网络",
+      "profile": "配置档",
+      "status": "状态",
+      "disk": "磁盘"
+    },
+    "cli": {
+      "usage": "用法：ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|policy|mithril|prune|switch-network|snapshot|compose|settings [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--execute] [--json]"
+    },
+    "clients": {
+      "el": "执行层客户端",
+      "cl": "共识层客户端"
+    },
+    "mithril": {
+      "label": "先用 Mithril 快照还原（测试网建议）",
+      "action": "用 Mithril 还原"
+    },
+    "errors": {
+      "notFound": "找不到验证者节点实例",
+      "invalidId": "实例标识无效",
+      "diskLow": "此链、网络与配置档所需的可用磁盘空间不足",
+      "diskUnknownMainnet": "无法测量可用磁盘，拒绝建立主网节点",
+      "needDocker": "需要 Docker Compose，但找不到",
+      "composeFailed": "docker compose 失败",
+      "needConfirm": "清空须 confirm=实例标识 或 CLEAR",
+      "mithrilAdaOnly": "Mithril 还原只适用于 Cardano",
+      "needMithrilConfirm": "Mithril 需要 confirm=实例标识 或 MITHRIL",
+      "mithrilBlocked": "Mithril 的 docker run 被允许清单拒绝",
+      "mithrilKey": "无法载入 Mithril genesis 验证密钥",
+      "mithrilFailed": "Mithril 快照下载失败",
+      "pruneFailed": "清理失败",
+      "switchNeedStop": "转网络前请先停止节点",
+      "switchNeedClear": "转网络会清空链数据。请用实例标识或 CLEAR 确认",
+      "composeMissing": "找不到 Compose 文件",
+      "composeNotManaged": "拒绝写入非 YSK 管理的 Compose 文件",
+      "badDataPath": "数据路径必须是绝对目录，并且不可使用系统路径",
+      "portInUse": "该 RPC 端口已被另一个验证者实例使用",
+      "snapshotUnsupported": "此链没有在允许清单内的快照来源",
+      "snapshotLookup": "无法解析官方快照指针",
+      "needSnapshotConfirm": "还原快照须 confirm=实例标识 或 SNAPSHOT",
+      "snapshotBlocked": "快照的 docker run 被允许清单拒绝",
+      "snapshotFailed": "快照下载或解压失败"
+    },
+    "notes": {
+      "beta": "此功能属 Beta。变更主机须 root 及 YSK_EXECUTE=1。",
+      "noKeys": "YSK Server 不会生成或保存质押私钥。",
+      "dockerSoon": "Install and start from this page wizard. Host changes need root and YSK_EXECUTE=1.",
+      "dryCreate": "已写入实例规格与 compose（dry-run）。要启动容器请加 --execute 及 YSK_EXECUTE=1。",
+      "dryStart": "启动为 dry-run。请加 --execute 及 YSK_EXECUTE=1。",
+      "dryStop": "停止为 dry-run。请加 --execute 及 YSK_EXECUTE=1。",
+      "dryClear": "清空为 dry-run。请加 --execute 及 YSK_EXECUTE=1。",
+      "created": "已建立节点并启动 compose",
+      "started": "已启动节点",
+      "stopped": "已停止节点",
+      "cleared": "已清空链数据",
+      "dryMithril": "Mithril 还原为试运行。请加 --execute 及 YSK_EXECUTE=1。",
+      "mithril": "已用 Mithril 还原快照并重启节点",
+      "dryPrune": "清理为试运行。请加 --execute 及 YSK_EXECUTE=1。",
+      "pruned": "已清理此项目未用映像",
+      "pruneProfile": "客户端原生修剪靠 pruned／minimal 配置档。要改请重建实例。",
+      "sameNetwork": "已经在这个网络",
+      "drySwitch": "转网络为试运行。",
+      "switched": "已转网络并清空链数据",
+      "dryCompose": "将写入 compose.yml",
+      "composeWrote": "已写入 compose.yml",
+      "statsEmpty": "没有运行中的容器可测量",
+      "autoClearNone": "没有已停止的实例可供自动清空",
+      "drySnapshot": "快照还原为试运行。请加 --execute 及 YSK_EXECUTE=1。",
+      "snapshotEthEl": "已还原 ethPandaOps 执行层归档，并重置共识层以使用 checkpoint sync",
+      "snapshotEthCl": "已重置共识层数据，使用官方 checkpoint sync",
+      "snapshotNear": "已清空 NEAR 数据；compose 会重新用官方 genesis 与 epoch sync 初始化",
+      "nativePrune": "已执行客户端原生清理命令",
+      "dryDelete": "删除属预演。真正套用须 --execute 与 YSK_EXECUTE=1。",
+      "deleted": "已删除节点"
+    },
+    "create": "建立节点",
+    "wizard": {
+      "title": "建立节点",
+      "back": "上一步",
+      "next": "下一步",
+      "install": "安装",
+      "mainnetWarn": "主网需要大量可用磁盘（ETH 常达 800 GiB 或以上）。建议先用测试网。",
+      "mainnetAck": "我明白磁盘与罚没风险，仍要建立主网节点。",
+      "heavyWarn": "此链负载很重（大量磁盘与高 IOPS）。Solana 主网通常需要 2 TiB 或以上。",
+      "memory": "内存上限（例如 4g）",
+      "cpus": "CPU 上限（例如 2.0）",
+      "dataPath": "数据路径（可选）",
+      "rpcPort": "RPC 端口（可选）",
+      "stepOf": "Step {{n}} / {{total}}",
+      "stepChain": "Chain",
+      "stepNetwork": "Network",
+      "stepProfile": "Profile",
+      "stepSummary": "Summary",
+      "needDocker": "Docker Engine is not installed. Install it first — this button stays disabled.",
+      "diskNeed": "This profile needs about {{need}} · free {{free}}",
+      "diskShort": "Not enough free disk for this chain / network / profile",
+      "limitNone": "No limit",
+      "rpcDefault": "Default",
+      "customPath": "Use a custom data path",
+      "installConfirmTitle": "Install this node?",
+      "installConfirmDesc": "{{chain}} · {{network}} · {{profile}}. About {{disk}} of disk. The image pull can take a long time.",
+      "installC1": "Several gigabytes of images may be downloaded.",
+      "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically."
+    },
+    "actions": {
+      "detail": "详情",
+      "start": "启动",
+      "stop": "停止",
+      "restart": "重新启动",
+      "clear": "清空",
+      "upgrade": "升级",
+      "clearConfirm": "输入实例标识或 CLEAR",
+      "prune": "清理映像",
+      "switchNetwork": "转网络",
+      "removeUnit": "一并删除 compose／实例记录",
+      "restoreAfter": "清空后还原快照",
+      "delete": "删除",
+      "deleteTitle": "删除 {{id}}",
+      "deleteDesc": "此操作会从面板移除节点。",
+      "deleteC1": "会停止并移除 Docker Compose",
+      "deleteC2": "会删除磁盘上的链数据",
+      "deleteC3": "会删除实例记录",
+      "pruneTitle": "清理未用映像",
+      "pruneDesc": "输入实例标识，以清理此节点 Compose 未用映像。",
+      "pruneC1": "会删除此 Compose 项目标签下未使用的映像。",
+      "clearTitle": "清空 {{id}}",
+      "clearC1": "会删除磁盘上的链数据。",
+      "clearC2": "实例仍留在面板，状态为已停止、无数据。",
+      "switchTitle": "转网络",
+      "switchC1": "会先停机并清空链数据，再写入新网络。"
+    },
+    "policy": {
+      "label": "升级策略",
+      "manual": "手动",
+      "notify": "通知",
+      "auto-safe": "自动（安全）",
+      "auto-all": "自动（全部）"
+    },
+    "logs": {
+      "empty": "尚无日志",
+      "follow": "跟随日志"
+    },
+    "compose": {
+      "label": "Compose 文件",
+      "save": "保存 compose"
+    },
+    "snapshot": {
+      "action": "还原快照",
+      "mithril": "Cardano 用 Mithril 做认证快照还原。",
+      "eth": "Ethereum 主网用官方 checkpoint sync 引导共识客户端。执行层继续 snap sync。",
+      "ethEl": "Hoodi／Sepolia 可还原 ethPandaOps 执行层归档，再用 checkpoint sync 引导共识层。",
+      "avax": "Avalanche 在 compose 配置档使用 state-sync。",
+      "near": "官方免费 NEAR tar 快照已停用。还原会清空数据，再用官方 genesis 与 epoch sync。",
+      "none": "此链未设置快照来源。"
+    },
+    "stake": {
+      "title": "准备质押（私钥由你保管）",
+      "offlineKeys": "离线生成密钥。面板永不保存。",
+      "deposit": "在官方 launchpad 完成存款／登记。",
+      "withdrawal": "自行设置提取凭证。",
+      "monitor": "在此页留意磁盘、对等节点与升级徽章。"
+    },
+    "alerts": {
+      "diskTitle": "验证者节点磁盘危急",
+      "diskBody": "验证者数据卷可用空间极低。",
+      "upgradeTitle": "验证者节点有可用升级",
+      "upgradeBody": "一个或多个客户端有较新的钉选版本。",
+      "syncTitle": "验证者节点需要留意",
+      "syncBody": "有节点已同步超过 6 小时，或回报错误。",
+      "rollbackTitle": "验证者升级已回滚",
+      "rollbackBody": "{{id}} 升级健康检查失败，已回滚。"
+    },
+    "upgrade": {
+      "changelog": "更新记录"
+    },
+    "readiness": {
+      "dockerTitle": "验证者节点所需的 Docker",
+      "dockerOk": "有 {{count}} 个验证者实例；已安装 Docker",
+      "dockerMissing": "已有验证者实例，但找不到 docker 命令"
+    },
+    "detail": {
+      "status": "状态",
+      "sync": "同步",
+      "peers": "对等节点",
+      "version": "版本",
+      "access": "访问",
+      "upgrade": "升级",
+      "upgradeHint": "选择此节点如何跟进客户端版本。",
+      "network": "网络",
+      "networkHint": "转网络会停机并清空链数据。请先在「清空数据」确认。",
+      "maintain": "维护",
+      "danger": "清空数据",
+      "dangerHint": "输入实例标识或 CLEAR。此操作会删除磁盘上的链数据。",
+      "compose": "Compose",
+      "logs": "日志"
+    },
+    "state": {
+      "unknown": "未知",
+      "stopped": "已停止",
+      "running": "运行中",
+      "syncing": "同步中",
+      "error": "错误"
+    }
   },
   "vnc": {
     "pageDesc": "VNC 服务器／客户端",
@@ -11686,6 +13556,8 @@
     "needViewer": "Viewer（可选）",
     "needViewerOrNovnc": "需 viewer 或 noVNC",
     "settingsHint": "新建账号默认",
+    "settingsNeedStack": "此处默认值要在已安装 TigerVNC（若选 XFCE 亦需 XFCE）后才会生效。请先到「安装」分页安装。",
+    "clientNeedNovnc": "「在浏览器开启」需要 noVNC。若要在此开启远端，请先到「安装」分页安装。",
     "defaultDesktop": "默认桌面",
     "defaultGeometry": "默认分辨率",
     "defaultDepth": "色深",
@@ -11804,15 +13676,22 @@
     "stackMissingShort": "未安装",
     "editClientTitle": "编辑远程客户端",
     "editClientDesc": "更新连接路径、主机与可选已存密码。",
-    "clientUpdated": "已更新客户端配置"
+    "clientUpdated": "已更新客户端配置",
+    "rememberNeedPassword": "请先填密码。",
+    "needXfceFirst": "Install XFCE first",
+    "needSessionRunning": "Session is not running — start it first",
+    "deleteKeepUserWarn": "The Linux user will stay on the host as an orphan. You must clean it up later.",
+    "bindRfbLine": "RFB {{bind}} :{{port}}",
+    "bindNovncLine": "noVNC 127.0.0.1:{{port}}",
+    "bindNovncHint": "noVNC listens on localhost. The desktop is reached through this panel, not the public internet, unless RFB bind is all interfaces."
   },
   "vpn": {
     "pageDesc": "VPN 服务器／客户端",
     "eyebrow": "VPN",
     "tab": {
-      "wireguard": "线卫",
-      "openvpn": "开放VPN",
-      "outline": "影袜",
+      "wireguard": "WireGuard",
+      "openvpn": "OpenVPN",
+      "outline": "Shadowsocks",
       "client": "本机连出",
       "software": "软件",
       "monitor": "监控",
@@ -11935,6 +13814,21 @@
       "lanCidrs": "区域网段",
       "customCidr": "CIDR",
       "addCidr": "添加"
-    }
+    },
+    "engineNotInstalled": "此主机尚未安装此 VPN 引擎。",
+    "serverNotListening": "服务器单元未在运行。UDP/TCP {{port}} 可能未监听。",
+    "installEngineFirst": "首先安装VPN引擎",
+    "portHint": {
+      "51820": "默认 WireGuard 监听端口",
+      "51821": "备用 WireGuard 侦听端口",
+      "51822": "第二个备用 WireGuard 侦听端口"
+    },
+    "needServerRunning": "{{engine}} is not running — apply the server first",
+    "engineSummarySoftware": "{{installed}} installed · {{running}} running",
+    "privateKeyOnce": "The client private key is shown only here. Download or copy it now — it cannot be recovered later.",
+    "showPrivateKey": "Show private key",
+    "hidePrivateKey": "Hide private key",
+    "deletePeerTitle": "Delete peer {{name}}?",
+    "deletePeerDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the config cannot be restored."
   }
 }