ysk-server-shared 1.0.0 → 1.1.9

package/locales/en/fail2ban.json

@@ -8,10 +8,10 @@
   "startService": "Start service",
   "notInstalled": "fail2ban is not installed",
   "toolHintPrefix": "Underlying tools:",
-  "toolHintBody": "fail2ban = after scanning logs,",
-  "toolHintTemp": "temporary",
-  "toolHintBody2": "bans · for attack response use",
-  "toolHintUfw": "UFW = ports / permanent rules",
+  "toolHintBody": "fail2ban temporarily bans after scanning logs. For attack response use",
+  "toolHintTemp": "",
+  "toolHintBody2": "",
+  "toolHintUfw": "handles ports and permanent rules.",
   "tabs": {
     "bans": "Ban list",
     "whitelist": "Whitelist",
@@ -36,11 +36,15 @@
   "emptyBansDesc": "Or no permission to read fail2ban-client",
   "ignoreipTitle": "ignoreip whitelist",
   "ignoreipDesc": "IPs never banned (panel file + optional live fail2ban-client)",
+  "whitelistEmptyWarn": "Whitelist is empty while jails can ban you. Add your login IP before applying ignoreip.",
+  "suggestIgnoreLogin": "Your login IP {{ip}}",
+  "applyIgnoreEmptyWarn": "Applying with an empty whitelist clears ignoreip",
+  "applyIgnoreNeedConfirm": "Rewrites jail ignoreip and reloads fail2ban",
   "addIp": "Add IP",
   "addWhitelist": "Add to whitelist",
   "applyPolicyIgnoreip": "Apply policy (incl. ignoreip)",
   "applyIgnoreipOk": "Wrote ignoreip into jail.local and applied",
-  "ignoreipHint": "Without YSK_EXECUTE only panel file is written (apply_status=written);",
+  "ignoreipHint": "Without system-change permission only the panel file is written. Apply policy rebuilds jail.local ignoreip and reloads.",
   "whitelistTitle": "Whitelist ({{count}})",
   "whitelistRemoved": "Removed from whitelist",
   "remove": "Remove",
@@ -78,5 +82,26 @@
     "reload": "fail2ban reloaded",
     "restart": "fail2ban restarted",
     "stop": "fail2ban stopped"
-  }
+  },
+  "statWhitelist": "Whitelist",
+  "invalidIp": "Enter a valid IPv4, IPv6, or CIDR.",
+  "whitelistPendingApply": "Saved to the panel list. Press Apply policy to write jail.local.",
+  "ignoreipFile": "dataDir/fail2ban/ignoreip.txt",
+  "jailsTabHint": "Status of active jails. Turn jails on or off in the Policy tab.",
+  "colJail": "Jail",
+  "colEnabled": "On",
+  "serviceStateLine": "Unit {{unit}} · {{state}} · boot {{boot}}",
+  "jail": {
+    "sshd": "SSH brute-force",
+    "nginxHttpAuth": "Nginx HTTP authentication",
+    "nginxBotsearch": "Nginx scanner / bot probes",
+    "nginxBadbots": "Nginx known bad bots",
+    "nginxLimitReq": "Nginx rate-limit jail",
+    "postfix": "Postfix mail brute-force",
+    "dovecot": "Dovecot mail login",
+    "recidive": "Repeat offenders"
+  },
+  "cannotBanSelf": "This is the host or your login IP — add it to ignoreip instead of banning",
+  "suggestIgnoreHint": "Suggested admin IPs (panel file only until you apply policy):",
+  "suggestIgnoreAdd": "Add {{ip}}"
 }

package/locales/en/files.json

@@ -1,5 +1,7 @@
 {
   "pillFiles": "{{count}} files",
+  "pillTrash": "{{count}} in trash",
+  "pillSpace": "{{used}} used",
   "statFiles": "Files",
   "statFolders": "Folders",
   "statUsage": "Usage",
@@ -58,10 +60,14 @@
   "selectAllAria": "Select all",
   "selectAll": "Select all",
   "folder": "Folder",
+  "dirNamedLikeFile": "(folder leftover; name looks like a file)",
   "dropToUpload": "Drop to upload",
   "trashTitle": "Trash ({{count}})",
   "trashDesc": "Deleted files can be restored or permanently removed",
   "emptyTrash": "Empty trash",
+  "emptyTrashTitle": "Empty trash?",
+  "emptyTrashDesc": "Every file in trash will be permanently deleted. This cannot be undone.",
+  "purgeForeverDesc": "This file will be permanently deleted. This cannot be undone.",
   "emptyTrashDone": "Trash emptied",
   "colOrigPath": "Original path",
   "colDeletedAt": "Deleted at",
@@ -89,12 +95,16 @@
   "enabledMount": "Enabled · {{path}}",
   "notEnabled": "Not enabled",
   "disable": "Disable",
+  "webdavAlreadyOff": "WebDAV is already off",
   "webdavDisabled": "WebDAV disabled",
   "webdavEnabledNoEcho": "Enabled (password will not be shown again; re-issue if needed)",
   "webdavDefaultOff": "Off by default — click Enable and issue token to start",
+  "webdavAfterEnable": "Available after you enable WebDAV and issue a token.",
   "webdavOn": "Enabled",
   "webdavOff": "Disabled",
+  "webdavOffNoToken": "Disabled (no active token)",
   "webdavTokenId": "Token #{{id}}",
+  "webdavTokenInactive": "Disabled — token #{{id}} is not active",
   "webdavUpdated": "Updated {{at}}",
   "webdavTokenOnceTitle": "Copy the password now",
   "webdavTokenOnceHint": "This password is shown only once; it cannot be retrieved after you leave this page.",
@@ -186,6 +196,9 @@
   "movedToTrash": "Moved to trash",
   "moveToTrashTitle": "Move to trash?",
   "moveToTrashDesc": "Delete {{count}} item(s) (restorable from trash)",
+  "deleteMore": " and {{n}} more",
+  "unshareTitle": "Revoke this share?",
+  "unshareDesc": "Revoke the link for {{name}} ({{url}}). The link stops working immediately.",
   "preview": "Preview",
   "imagePreviewNeedLogin": "Image preview needs login; use download instead",
   "pdfDownloadHint": "Download PDF to open (needs auth headers)",
@@ -316,5 +329,35 @@
   "publicShareBtFailed": "WebTorrent failed: {{detail}}",
   "publicShareBtNeedMagnet": "No magnet URI for this share",
   "publicShareBtUnsupported": "This browser cannot run WebTorrent; use magnet or .torrent instead",
-  "btNone": "—"
+  "btNone": "—",
+  "uploadStatusSkipped": "Skipped",
+  "uploadStatusCancelled": "Cancelled",
+  "conflict": {
+    "titleFile": "An item named “{{name}}” already exists",
+    "titleFolder": "A folder named “{{name}}” already exists",
+    "descFile": "Choose what to do. Nothing is overwritten until you pick Replace.",
+    "descFolder": "Choose what to do. Merge keeps the existing folder and continues with its contents.",
+    "incoming": "Incoming",
+    "existing": "Already here",
+    "kindFile": "File",
+    "kindFolder": "Folder",
+    "skip": "Skip",
+    "skipHint": "Do not add this item",
+    "keepBoth": "Keep both",
+    "keepBothHint": "Save incoming as {{name}}",
+    "replace": "Replace",
+    "replaceHint": "Overwrite the existing file. A version snapshot is kept when possible.",
+    "replaceFolderHint": "Overwrite files with the same names inside this folder. Other files stay.",
+    "merge": "Merge",
+    "mergeHint": "Keep the existing folder and add incoming files into it",
+    "applyAll": "Apply to all remaining conflicts",
+    "applyAllHint": "Use this action for the rest of this drop or transfer",
+    "cancelRest": "Cancel remaining",
+    "progress": "{{current}} of {{total}}",
+    "typeMismatch": "A {{destKind}} named “{{name}}” is already here. Incoming is a {{incomingKind}}.",
+    "skipped": "Skipped",
+    "cancelled": "Cancelled"
+  },
+  "webdavReissueUnchanged": "Token id did not change after re-issue — the write may not have persisted. Try again.",
+  "webdavDisableFailed": "WebDAV is still enabled after disable — the write may not have persisted. Try again."
 }

package/locales/en/firewall.json

@@ -20,6 +20,8 @@
   "statAllow": "Allow",
   "statDeny": "Deny",
   "statDefaultIn": "Default incoming",
+  "defaultNotApplied": "n/a (UFW off)",
+  "ufwOffHint": "Default incoming is not applied while UFW is off",
   "executeOn": "On",
   "executeOff": "Off",
   "ufwDisabled": "UFW disabled",
@@ -29,6 +31,7 @@
   "notInstalled": "UFW is not installed",
   "toolHintPrefix": "Underlying tools:",
   "toolHintBody": "UFW = ports / permanent rules · for attack response and auto-ban use",
+  "toolHintfail2ban": "fail2ban = temporary log-based bans",
   "toolHintFail2ban": "fail2ban = temporary log-based bans",
   "executeOffHint": "System changes off — status is readable;",
   "tabs": {
@@ -89,6 +92,7 @@
   "deleteRuleDesc": "Removes that UFW rule number (needs system-change permission).",
   "servicesTitle": "Managed services",
   "servicesHint": "Desired network exposure for YSK services. Opening a service syncs these rules automatically.",
+  "servicesUfwOff": "UFW is off. This list is the desired exposure, not rules the host is enforcing.",
   "servicesEmpty": "No service exposure data yet",
   "servicesEmptyDesc": "Start a managed service (web, FTPS, VPN, DB…) to populate this list.",
   "servicesManualHint": "Manual port chips are under the Ports tab — prefer managing access here so rules stay tagged (ysk-svc).",
@@ -98,5 +102,10 @@
   "colPorts": "Ports",
   "colSync": "Status",
   "synced": "Synced",
-  "syncNow": "Sync"
+  "syncNow": "Sync",
+  "disableConfirmTitle": "Disable UFW?",
+  "disableConfirmDesc": "The host firewall will stop filtering traffic. SSH and the panel can be exposed if the host is on a public network.",
+  "disableConfirmConsequence": "Existing allow/deny rules stay stored but are not enforced until UFW is enabled again.",
+  "desiredOnlyUfwOff": "Desired: {{mode}} · UFW off (not applied)",
+  "syncNotApplied": "UFW off · not applied"
 }

package/locales/en/ftp.json

@@ -53,6 +53,22 @@
   "accountCount": "Accounts",
   "loginBanner": "Login banner",
   "sslDomain": "SSL domain",
+  "plaintextInsecure": "Cleartext FTP (no TLS) — insecure. Enable FTPS before exposing port 21.",
+  "plaintextPublicLive": "vsftpd is listening on a public address without FTPS. Credentials travel in the clear. Enable FTPS, bind to this host only, or confirm PLAINTEXT to keep this posture.",
+  "bindAddress": "Listen scope",
+  "bindAddressHint": "New installs bind to this host only. Public listen without FTPS needs a typed confirmation.",
+  "bindLocal": "This host only",
+  "bindLocalHint": "127.0.0.1 — fine without TLS for local tests",
+  "bindPublic": "Public",
+  "bindPublicHint": "All interfaces — enable FTPS or confirm PLAINTEXT",
+  "enableFtpsAndStart": "Enable FTPS and start",
+  "publicPlainNeedConfirm": "Public cleartext FTP needs a PLAINTEXT confirmation",
+  "plainConfirmTitle": "Start public FTP without FTPS?",
+  "plainConfirmDesc": "Port 21 will accept logins and data in the clear on the public address.",
+  "plainConfirmC1": "Usernames and passwords are visible on the network.",
+  "plainConfirmC2": "PASV will advertise the configured public IP.",
+  "plainConfirmC3": "Host firewall and cloud security group are not opened for you.",
+  "plainConfirmAction": "Start cleartext FTP",
   "pasvRange": "PASV range",
   "forceTls": "Force TLS",
   "allowWrite": "Allow write",
@@ -61,7 +77,13 @@
   "listenPortHint": "Default 21; open firewall if using another port",
   "customPort": "Custom port",
   "ipStack": "IP stack",
-  "ipStackHint": "Most vsftpd builds: listen and listen_ipv6 are mutually exclusive;",
+  "ipStackHint": "Most vsftpd builds: listen and listen_ipv6 are mutually exclusive.",
+  "listenConflictLive": "Live vsftpd.conf has listen={{v4}} and listen_ipv6={{v6}} — both YES will fail to start.",
+  "listenConflictNeedFix": "Fix listen / listen_ipv6 first (they cannot both be YES), then apply.",
+  "fixListenIpv4": "Use IPv4 only (listen=YES, listen_ipv6=NO)",
+  "liveFileValue": "File now: {{value}}",
+  "startBlockedFailed": "Service is failed — apply a valid config before start",
+  "ftpsNeedCert": "Pick a certificate domain first",
   "ipv4Only": "IPv4 only",
   "ipv6Mapped": "IPv6 (mapped OK)",
   "bannerHint": "Welcome string clients see after connect",
@@ -73,7 +95,10 @@
   "openFirewallPage": "Open firewall page",
   "customEnd": "Custom end",
   "pasvPublicIp": "PASV public IP",
+  "detectPublicIp": "Detect public IP",
+  "detectPublicIpTitle": "Fill the first non-loopback IPv4 from this host",
   "pasvPublicIpHint": "NAT/cloud: set public IP; local can leave empty",
+  "pasvIpRequired": "Set a public PASV IP before apply (NAT/cloud). Detect or type an address.",
   "optionalEmpty": "(optional)",
   "securityTitle": "Security settings",
   "securityDesc": "TLS, write access, chroot; Apply and restart to take effect",
@@ -95,7 +120,7 @@
   "opsResult": "Ops result",
   "saved": "Saved",
   "accountsList": "Account list",
-  "accountsListDesc": "After create, Apply to sync vsftpd. If service missing, install above then ",
+  "accountsListDesc": "After create, Apply to sync vsftpd. If it is not installed, use the Software tab.",
   "startService": " start.",
   "createAccountPlus": "+ Create account",
   "noFtpAccounts": "No FTP accounts yet",
@@ -131,5 +156,11 @@
   "sftpRegister": "Register key",
   "sftpAddedAt": "Added {{time}}",
   "sftpTechSummary": "Technical details (advanced)",
-  "sftpTechNote": "Keys are written under the managed path"
+  "sftpTechNote": "Keys are written under the managed path",
+  "filterProject": "Showing FTP accounts for this project",
+  "clearProjectFilter": "Show all accounts",
+  "vsftpdFailedHint": "vsftpd failed. Open the Service tab (listen and listen_ipv6 cannot both be YES).",
+  "vsftpdFailedGeneric": "vsftpd failed. Open the Service tab for live settings and journal.",
+  "stateFailed": "Failed to start",
+  "tabService": "Service"
 }

package/locales/en/hostBrowse.json

@@ -18,6 +18,7 @@
   "viaHost": "via host",
   "emptyTitle": "Host-mediated browse",
   "emptyBody": "Enter a URL. DNS, TLS, and egress use this server — not your browser. Cookies stay in a server-side jar.",
+  "needUrl": "Enter a URL above to start a session.",
   "ssrfBlocked": "Blocked by security policy (SSRF / mode)",
   "loadFailed": "Fetch failed on host",
   "sessionReady": "Session ready",
@@ -36,12 +37,15 @@
   "engineBrowser": "Real browser",
   "engineSwitchHint": "Switching engine opens a new session.",
   "needChrome": "Real browser needs system Chrome/Chromium (or set YSK_HOST_BROWSE_CHROME). Using proxy otherwise.",
+  "engineBrowserNeedChrome": "Real browser (Chrome not installed)",
+  "egressHint": "The target site sees this server’s outbound address ({{host}}), not your laptop. Cookies stay in the server session jar.",
   "needChromeFallback": "Chrome unavailable — switched to proxy engine.",
   "liveError": "Live stream failed",
   "liveWaiting": "Connecting host browser…",
   "tabSettings": "Settings",
   "softwareNeeded": "Chromium / Chrome required for real browser engine",
-  "softwareHint": "One-click installs distro Chromium via apt. Google Chrome binary is also detected if already present. Requires root + YSK_EXECUTE=1.",
+  "softwareHint": "One-click installs distro Chromium via apt. Google Chrome is also detected if already present. Needs superuser and system-change permission.",
+  "closeNoSession": "No session yet",
   "goInstallChrome": "Open Software tab",
   "settingsIntro": "These panel settings override process environment variables for Host Browse.",
   "settingsEngine": "Default engine",
@@ -82,6 +86,8 @@
   },
   "home": "Home",
   "bookmark": "Bookmark",
+  "bookmarkAdd": "Add or remove bookmark",
+  "bookmarkList": "Bookmark list",
   "bookmarks": "Bookmarks",
   "history": "History",
   "bookmarkToggled": "Bookmark updated",
@@ -90,6 +96,9 @@
   "mediaNote": "Real browser: video is streamed into the panel. Enable audio bridge in Settings to hear page audio (requires user gesture).",
   "isolationNote": "Real browser creates an ephemeral Linux user for Chrome; leaving the page or idle timeout destroys that user.",
   "resumeHint": "Resume previous session ({{count}} tabs)",
+  "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}",
+  "resumeHintOwned": "Resume last browse for {{user}} ({{count}} tabs) · {{url}} · {{when}}",
+  "clearSessionData": "Clear session data",
   "resume": "Resume",
   "resumeDismiss": "Dismiss",
   "resumeDone": "Session resumed",
@@ -124,5 +133,18 @@
   "mediaAudioLabel": "Audio",
   "mediaAudioDesc": "Optional bridge from host Chrome; may require unlock click.",
   "mediaPolicyLabel": "Policy",
-  "mediaPolicyDesc": "Downloads and autoplay follow the safety and download settings above."
+  "mediaPolicyDesc": "Downloads and autoplay follow the safety and download settings above.",
+  "frameBlocked": "The page could not be shown in the panel frame.",
+  "historyEmpty": "No history in this session.",
+  "bookmarksEmpty": "No bookmarks yet.",
+  "closeSessionHint": "Clears cookies for this browse session. Bookmarks stay.",
+  "envUnset": "not set",
+  "envPanelValue": "panel: {{value}}",
+  "envColVar": "Variable",
+  "envColHost": "Host process",
+  "envColPanel": "Panel setting",
+  "envColEffective": "Effective",
+  "settingsNoSandboxWarn": "Disables Chromium sandbox. Use only inside a trusted container. Applies on next real-browser session.",
+  "settingsDangerDlWarn": "Allows executable and script downloads through the host browser. Confirm you need this.",
+  "settingsDangerConfirmTitle": "Enable a high-risk browse setting?"
 }

package/locales/en/listToolbar.json

@@ -8,5 +8,6 @@
   "activeFilters": "{{count}} filters active",
   "noResults": "No matches",
   "noResultsHint": "Try another keyword or clear filters.",
-  "searching": "Searching…"
+  "searching": "Searching…",
+  "emptyChip": "No items in this filter"
 }

package/locales/en/login.json

@@ -10,5 +10,10 @@
   "totpLabel": "Authentication code",
   "totpHint": "6-digit code from your authenticator app",
   "submitting": "Signing in…",
-  "sessionExpired": "Session expired; sign in again"
+  "sessionExpired": "Session expired; sign in again",
+  "newPassword": "New password",
+  "newPasswordAgain": "Confirm new password",
+  "changePassword": "Change password",
+  "passwordMismatch": "The two passwords do not match",
+  "passwordChanged": "Password updated"
 }

package/locales/en/logs.json

@@ -45,6 +45,9 @@
   "followingSse": " · following (SSE)",
   "loadingSources": "Loading sources…",
   "pickSource": "Pick a source on the left, or a shortcut · then Query",
+  "noRowsInWindow": "No records in this time window",
+  "showInactiveUnits": "Show inactive units",
+  "sseNeedFollow": "Turn on Follow first — SSE is only for live tail",
   "maintOverview": "Maintenance overview",
   "executable": "Executable",
   "restricted": "Restricted",
@@ -108,8 +111,11 @@
   "lines": "{{n}} lines",
   "followingSseDyn": " · following{{sse}}",
   "ipBan": "IP → ban",
-  "vacuumNote": "Free systemd-journal disk. No EXECUTE → blocked, no fake success.",
-  "vacuumTime": "Vacuum time",
+  "vacuumNote": "Reclaims systemd-journald disk. Without execute permission the action is blocked — it is not treated as success.",
+  "vacuumTime": "Clean by retention",
+  "vacuumNeedRetention": "Enter a retention window first (for example 14d)",
+  "vacuumNeedConfirm": "Needs confirmation — deletes old journal logs",
+  "vacuumSizeNeedConfirm": "Needs confirmation — caps journal disk use",
   "vacuumHint": "Keep ≥7 days recommended; re-probe disk after.",
   "logrotateStatus": "System logrotate status (read-only probe)",
   "logrotateMissing": "No status file or unreadable — check logrotate package in services matrix",
@@ -117,12 +123,13 @@
   "relatedOpsDesc": "Log observation vs incident response",
   "scLogsLine": "Observe journal / files / projects",
   "scProtLine": "Incident response, auto ban (click IP)",
-  "journalVacuumTitle": "Journal vacuum",
+  "journalVacuumTitle": "Clean journald disk",
   "journalSection": "Journal",
   "sseLabel": "SSE",
   "logrotateLabel": "logrotate",
   "srcNginx": "nginx",
   "srcSsh": "ssh",
+  "srcfail2ban": "fail2ban",
   "srcFail2ban": "fail2ban",
   "srcAuthLog": "auth.log",
   "srcNginxError": "nginx error",
@@ -131,5 +138,27 @@
   "groupVarLog": "/var/log",
   "prioErr": "err+",
   "prioWarn": "warn+",
-  "prioInfo": "info+"
+  "prioInfo": "info+",
+  "vacuumSize": "Limit to 500 MB",
+  "logrotateNoStatus": "No logrotate status file yet (normal if it has never run).",
+  "autoVacuumOff": "Automatic clean is off. Time is unused until you enable it.",
+  "aboutAllowlist": "Explore can only read allowlisted journal units and /var/log paths. Arbitrary host paths are not offered.",
+  "aboutCustomPath": "Add a custom path on Settings (only /var/log or /run/log). Then open it from Explore.",
+  "vacuumSizeAlreadyBelow": "Current usage already below cap, this will no-op",
+  "vacuumSizeNoopDesc": "Journal is already under 500 MB. This still runs vacuum --size=500M and typically deletes nothing.",
+  "journalDiskHint": "Current systemd-journald usage (active journal). Rotated files under /var/log are not included.",
+  "varLogDiskHint": "Estimated du of /var/log, including rotated files. Approximate.",
+  "queryFirst": "Query first",
+  "errorsWindowHint": "Recent errors from the last overview probe (not live-updating when you switch tabs)",
+  "sourceCount": "{{shown}} shown",
+  "sourceUnavailable": "This source has not produced a log yet",
+  "sourceNoLog": "No log yet",
+  "projectSourcesTitle": "{{n}} source(s) (files + journal)",
+  "logrotatePath": "Path",
+  "logrotateLast": "Last rotated",
+  "exportJsonl": "JSONL export",
+  "sseLive": " (live stream)",
+  "logrotateExpand": "Show {{n}} more",
+  "logrotateCollapse": "Show fewer",
+  "logrotateVersion": "Status version {{v}}"
 }

package/locales/en/metrics.json

@@ -27,6 +27,15 @@
     "alerts": "Alerts"
   },
   "load": "Load",
+  "load1m": "Load 1m",
+  "uptime": "Uptime",
+  "filterCpu5": "≥5% CPU",
+  "filterMem5": "≥5% memory",
+  "signalHint": "Select a process, then send TERM or KILL.",
+  "signalFromRow": "Select this process for TERM / KILL",
+  "selectForSignal": "Select",
+  "forceKillTitleNamed": "KILL PID {{pid}} ({{cmd}})?",
+  "sendSigTitleNamed": "Send TERM to PID {{pid}} ({{cmd}})?",
   "min1": "1m",
   "min5": "5m",
   "min15": "15m",
@@ -82,6 +91,8 @@
   "noProjectsDesc": "Create a project to see real home usage here",
   "usageNote": "Usage from local du (not estimated). Quota is a control-plane soft limit; hard setquota needs apply-to-host.",
   "thresholdAlerts": "Threshold alerts",
+  "alertsBuiltinOnly": "Built-in CPU / memory / disk thresholds only. No email, webhook, or Slack channel.",
+  "lastEvaluated": "Last checked",
   "alertsOkTitle": "All clear",
   "alertsOkDesc": "No memory / load / disk threshold alerts.",
   "cpu": "CPU",
@@ -98,6 +109,18 @@
   "selectAllAria": "Select all filtered",
   "selectPidAria": "Select PID {{pid}}",
   "controlPlane": "Control plane",
+  "controlPlaneNoSignal": "The control-plane process cannot be signalled",
+  "protectedPid": "PID 1 / init / systemd cannot be signalled from the panel",
+  "sigTermTitle": "Send SIGTERM (ask process to exit)",
+  "sigKillTitle": "Send SIGKILL (force kill — cannot be caught)",
+  "batchTerm": "TERM",
+  "batchKill": "KILL",
+  "rawTopLabel": "Raw top (untranslated)",
+  "followSseLabel": "Follow (live stream)",
+  "alertsReadOnly": "Built-in CPU / memory / disk thresholds only. No email, webhook, or Slack channel.",
+  "alertsGoNotifications": "Open notification centre",
+  "lastCheck": "Last check",
+  "rawTopHint": "Untranslated top(1) output",
   "detailShort": "Info",
   "procUnavailable": "Could not get processes",
   "noProcData": "No process data yet",
@@ -116,7 +139,7 @@
   "reniceHint": "-20 highest · 19 lowest (needs EXECUTE)",
   "noData": "No data",
   "mountsTitle": "Disk mounts ({{count}})",
-  "mountsDesc": "Real df -P -B1 (tmpfs filtered)",
+  "mountsDesc": "Real disk usage (temporary filesystems filtered)",
   "noMounts": "No mount list",
   "noMountsDesc": "df unavailable or filtered. Root disk still on Overview.",
   "seeProjectUsage": "Project home usage is on the Project usage tab (real du · {{size}})",
@@ -128,5 +151,17 @@
   "usageNoteFull": "Usage from local du (not estimated). Quota is a control-plane soft limit; hard setquota needs apply-to-host.",
   "sseNeedLogin": "Not logged in; cannot open SSE",
   "sseSessionExpired": "Not logged in or session expired; cannot open SSE",
-  "sseHttpError": "stream HTTP {{status}}"
+  "sseHttpError": "stream HTTP {{status}}",
+  "colFilesystem": "Filesystem",
+  "colMount": "Mount",
+  "colSize": "Size",
+  "colUsed": "Used",
+  "colAvail": "Available",
+  "colUsePct": "Used %",
+  "colHome": "Home",
+  "usageNoteLink": "Control-plane soft quota. Apply hard limits on the project Isolation tab.",
+  "shareNoQuotaHint": "No quota set, so share is not a percentage. Set a quota on the project Isolation tab.",
+  "setQuotaLink": "Set quota",
+  "unusualHome": "Unusual path",
+  "unusualHomeHint": "Not a /home/… project home. Canonical isolation is /home/ysk-server-{id}."
 }

package/locales/en/migrate.json

@@ -10,6 +10,9 @@
   "subtitle": "Source control plane → full copy to new host. Afterward only change public IP/DNS; accounts, paths, and projects stay the same.",
   "inventorying": "Inventorying",
   "inventoried": "Inventoried",
+  "inventoriedWarn": "Inventoried · {{n}} warnings",
+  "inventoriedOrphans": "Inventoried · {{n}} leftover homes",
+  "inventoriedWarnAndOrphans": "Inventoried · {{w}} warnings · {{n}} leftover",
   "inventoryFailed": "Inventory failed",
   "pendingInventory": "Pending inventory",
   "projects": "Projects",
@@ -38,6 +41,8 @@
   "authMethod": "Auth method",
   "rootPassword": "Root password",
   "notPersisted": "Not persisted",
+  "passwordNotStored": "Password is used for this SSH session only and is not saved on disk.",
+  "overwriteDanger": "Overwrite will replace existing YSK data on the target. This cannot be undone from the panel.",
   "outboundIdentity": "Outbound identity in vault",
   "dryRun": "Dry-run precheck",
   "startMigrate": "Start full-host migration",
@@ -66,6 +71,27 @@
   "restartApiHint": "If you just deployed a new version, restart the API (",
   "afterRestart": ") then Refresh.",
   "inventoryWarnings": "Inventory warnings ({{count}})",
+  "orphanHomesHint": "Leftover project homes (not in the store). Remove only after you confirm they are unused.",
+  "orphanHomesTitle": "Leftover project homes ({{count}})",
+  "orphanHomesSummary": "{{count}} path(s) on disk are not in the store. Back up first if unsure, then remove unused paths.",
+  "orphanColHome": "Home",
+  "orphanColModified": "Modified",
+  "orphanColEntries": "Entries",
+  "orphanEntries": "{{n}} top-level entries in the directory",
+  "orphanKpi": "Leftover",
+  "sourceOs": "OS",
+  "sourceDataDir": "dataDir",
+  "sourceDbRedis": "Databases / Redis",
+  "sourceDbRedisValue": "{{db}} databases · {{redis}} Redis",
+  "orphanRemove": "Remove",
+  "orphanRemoveTitle": "Delete leftover project home?",
+  "orphanRemoveDesc": "Permanently delete {{path}} from disk. This is not a store project. Needs superuser and system-change permission.",
+  "orphanRemovePhrase": "Type DELETE to confirm.",
+  "orphanRemoveNeedConfirm": "Needs confirmation",
+  "orphanBackupFirst": "Back up first (open Backups)",
+  "orphanMtime": "Last modified {{at}}",
+  "expandAllWarnings": "Show all {{n}} warnings",
+  "collapseWarnings": "Show fewer",
   "moreWarnings": "…and {{n}} more",
   "authPassword": "root password (switch to key after temp key install)",
   "authIdentity": "SSH identity vault identityId",
@@ -76,7 +102,7 @@
   "allowOverwriteDesc": "· Required if target already has ysk.json",
   "dryRunOnly": "Dry-run only",
   "dryRunOnlyDesc": "· Inventory + precheck only; no rsync or target writes",
-  "executeNote": "Host needs YSK_EXECUTE=1 and root API. After migrate, update DNS A/AAAA and check cloud firewall + mail PTR.",
+  "executeNote": "Host needs system-change permission and a superuser API. After migrate, update DNS A/AAAA and check cloud firewall + mail PTR.",
   "dnsCutover": "DNS cutover (manual)",
   "dnsCutoverDesc": "Point A/AAAA for these names to the new public IP;"
 }

package/locales/en/nav.json

@@ -53,7 +53,9 @@
     "runtimes": "Runtimes",
     "security": "Security",
     "system": "System",
-    "ai": "AI"
+    "ai": "AI",
+    "validators": "Validators",
+    "containers": "Containers"
   },
   "java": "Java",
   "kotlin": "Kotlin",
@@ -73,5 +75,10 @@
   "bookmarkAdded": "Pinned to sidebar",
   "bookmarkRemoved": "Removed from sidebar",
   "btTracker": "BT Tracker",
-  "support": "Support"
+  "support": "Support",
+  "noAccessTitle": "No access",
+  "noAccessDesc": "Your role does not include this page. Ask an admin if you need it.",
+  "backToDashboard": "Back to dashboard",
+  "validators": "Validators (Beta)",
+  "docker": "Docker"
 }

package/locales/en/network.json

@@ -3,6 +3,15 @@
   "canMutate": "Mutable",
   "readOnlyBlocked": "Read-only / blocked",
   "statIfaces": "Interfaces",
+  "statUp": "Up",
+  "oper": {
+    "up": "Up",
+    "down": "Down",
+    "unknown": "Unknown",
+    "loopback": "Always on",
+    "loopbackHint": "Loopback is always available and cannot be changed.",
+    "other": "Other"
+  },
   "statGateway": "Gateway",
   "pageActions": "Page actions",
   "loadingSnap": "Loading network snapshot…",
@@ -35,6 +44,8 @@
   "defaultDev": "Default egress: {{dev}}",
   "saveNm": "Save (NetworkManager, survives reboot)",
   "ephemeralHint": "Unchecked = live ip route add only",
+  "nmUnavailable": "NetworkManager is not running — only a live route can be added",
+  "defaultRouteDownNeedName": "This is the default route egress. Type the interface name to confirm — the panel may disconnect.",
   "saveRoute": "Save route",
   "dnsSettings": "DNS settings",
   "dnsNmHint": "Writes NM connection “{{conn}}” and reconnects (persistent)",
@@ -103,9 +114,17 @@
   "applyDnsNotes": "Apply runs nmcli connection modify + up; brief disconnect is normal. Stub 127.0.0.53 is not written (local resolved).",
   "testResolve": "Test resolve",
   "loadRaw": "Load raw output",
+  "hideRaw": "Hide raw output",
+  "rawLoadedAt": "Loaded {{time}}",
   "confirmDown": "Confirm Down",
+  "linkDownTitle": "Take {{name}} offline",
+  "linkDownNeedConfirm": "Type the interface name to confirm",
   "defaultRouteDownWarn": "This interface is the default route egress; down may cut panel access.",
   "deleteDefaultMayDrop": " — deleting default may drop connectivity.",
+  "deleteDefaultPanelWarn": "Deleting the default route can drop this panel session. Type DEFAULT to confirm.",
+  "deleteDefaultNeedConfirm": "Needs confirmation — type DEFAULT (may drop this panel)",
+  "deleteRouteNeedConfirm": "Needs confirmation",
+  "typeDefaultToConfirm": "Type DEFAULT to confirm",
   "gateway": "Gateway",
   "nameservers": "Nameservers",
   "searchDomains": "Search domains",
@@ -135,8 +154,14 @@
       "azure_frontdoor": "Azure Front Door",
       "gcore": "Gcore CDN",
       "custom": "Custom proxies"
-    }
+    },
+    "needProvider": "Choose a CDN provider before fetching its IP list.",
+    "spoofWarn": "Trusting the wrong CIDR lets clients spoof X-Forwarded-For / CDN headers as their IP."
   },
   "linkUp": "Up",
-  "linkDown": "Down"
+  "linkDown": "Down",
+  "linkDownDefault": "Down default route",
+  "loopbackImmutable": "Loopback cannot be changed",
+  "operUnknownHint": "Kernel did not report UP/DOWN (common for lo). The interface is still usable.",
+  "persistNmHint": "Persistable means changes can survive reboot via NetworkManager."
 }

package/locales/en/nginx.json

@@ -5,6 +5,8 @@
   "purgeOk": "Purged",
   "projectSitesHint": "Project sites (managed conf) and standalone sites are listed separately. Edit project Nginx under Projects → Network.",
   "purgeCache": "Purge cache + reload",
+  "purgeCacheTitle": "Purge Nginx cache and reload?",
+  "purgeCacheDesc": "Clears the on-disk cache and reloads Nginx. Live sites stay up.",
   "notInstalled": "Nginx is not installed",
   "listTitle": "Sites ({{count}})",
   "listDesc": "After create, click Apply to sync to the system",
@@ -80,5 +82,6 @@
   "setHsts": "HSTS",
   "setCfRealIp": "Cloudflare Real IP",
   "setIndexes": "Directory listing",
-  "bodyInherit": "Global"
+  "bodyInherit": "Global",
+  "stopSites": "{{n}} site(s) will stop answering HTTP."
 }