ysk-server-shared 1.0.0 → 1.1.9

package/locales/en/notFound.json

@@ -0,0 +1,6 @@
+{
+  "title": "Page not found",
+  "body": "No panel page at {{path}}.",
+  "hint": "Unknown URLs no longer send you to the dashboard.",
+  "home": "Dashboard"
+}

package/locales/en/notes.json

@@ -1,4 +1,7 @@
 {
+  "agents": {
+    "activatingStuck": "systemd unit has been activating for more than 5 minutes — treating as failed. Check journal."
+  },
   "notFound": "Not found",
   "needPath": "Specify a path",
   "needName": "Enter a name",
@@ -30,19 +33,53 @@
   },
   "ssh": {
     "identityNotFound": "Identity not found",
-    "registrationNotFound": "Registration not found"
+    "registrationNotFound": "Registration not found",
+    "keyOkNologin": "Key accepted. Account is nologin or SFTP-only (no SSH shell). Treated as PASS.",
+    "keyOkSftp": "SFTP pwd succeeded after SSH shell was refused."
   },
   "cdn": {
     "siteNotFound": "CDN site not found",
-    "nodeMissing": "Node does not exist"
+    "nodeMissing": "Node does not exist",
+    "loopbackOriginRemote": "Origin is 127.0.0.1 — that is this host, not a remote edge. Set a reachable origin IP or bind_ip.",
+    "originRemoteRewrite": "Remote edges will use reachable origin {{url}} instead of loopback.",
+    "originRemoteUnknown": "Origin is loopback and no public/LAN IP or bind_ip is known — apply will refuse remote edges until one is set.",
+    "needSshOrFleet": "Remote edge needs an outbound SSH identity (or username) or a /agents fleet session. Health URL alone is not apply transport.",
+    "probe": {
+      "timeout": "Connect timeout after {{ms}}ms ({{detail}}). Peer may be firewalled.",
+      "dns": "DNS lookup failed ({{detail}}).",
+      "refused": "Connection refused after {{ms}}ms ({{detail}}). Port closed or one-way block.",
+      "tls": "TLS verify failed ({{detail}}).",
+      "unreach": "Host unreachable after {{ms}}ms ({{detail}}).",
+      "http": "HTTP probe failed after {{ms}}ms ({{detail}})."
+    }
   },
   "backup": {
+    "testUnsaved": "Testing unsaved form values (not written to settings).",
+    "testIdentity": "sftp (identity) to {{spec}} ok",
+    "sshAuthFailed": "SSH key or password rejected (publickey). Pick an outbound identity or install sshpass.",
+    "remotePathIsFile": "Remote path {{path}} is a file. Use a directory.",
+    "remoteMkdirFailed": "Could not create remote directory: {{detail}}",
+    "sidecarPushed": "Also pushed SQL sidecar {{name}}",
     "fileNotFound": "Backup file not found",
     "resticNoPassword": "restic is enabled but password is not set",
-    "resticNotInPath": "restic not in PATH"
+    "resticNotInPath": "restic not in PATH",
+    "dbEnvUnreadable": "Could not read .db.env; skipped SQL dump.",
+    "dbEnvNoName": ".db.env has no database name; skipped SQL dump.",
+    "targetOutside": "Restore target must be inside the project home or the public files root.",
+    "controlPlaneDryRun": "Preview only — nothing written. In the panel, use Restore and confirm the phrase to write.",
+    "controlPlaneNeedConfirm": "Full control-plane restore needs the confirm phrase RESTORE-CONTROL-PLANE.",
+    "controlPlaneRestartAfter": "Restart the API after a successful restore.",
+    "movedToTrash": "Moved {{name}} to the recycle bin. Permanent delete after {{days}} days.",
+    "restoreNameExists": "Cannot restore {{name}} — a live archive with that name already exists.",
+    "restoredFromTrash": "Restored {{name}} from the recycle bin.",
+    "trashEmptied": "Permanently deleted {{n}} archive(s) from the recycle bin."
   },
   "redis": {
-    "cliMissing": "redis-cli is not installed"
+    "cliMissing": "redis-cli is not installed",
+    "requirepassAlreadySet": "Redis already has requirepass — not overwritten.",
+    "requirepassApplied": "requirepass applied at runtime",
+    "requirepassApplyFailed": "Could not CONFIG SET requirepass (will rely on restart + conf)",
+    "generatedRequirepass": "Generated Redis password (shown once): {{password}}"
   },
   "nginx": {
     "reloaded": "nginx reloaded",
@@ -65,7 +102,8 @@
     "vsftpdStarted": "vsftpd started",
     "openPortsStep": "Firewall ports (manual)",
     "openPortsReminder": "Open TCP ports on host firewall and cloud security group: {{ports}}. FTPS apply does not open ports for you.",
-    "openPortsPasvHint": "If login works but directory LIST times out, the PASV data range is blocked — open the ful"
+    "openPortsPasvHint": "If login works but directory LIST times out, the PASV data range is blocked — open the ful",
+    "publicPlaintextBlocked": "Refusing to start public FTP without FTPS. Bind to this host only, enable FTPS with a certificate, or confirm PLAINTEXT to expose cleartext on the public address."
   },
   "deploy": {
     "nodeMissingIsolated": "Node binary missing for isolated deploy: {{path}} — install Node {{version}} toolchain then redeploy. Refusing to write a unit that would 203/EXEC.",
@@ -83,7 +121,8 @@
     "pathOutsideSandbox": "Path outside sandbox: {{target}}",
     "notFoundRel": "Not found: {{relPath}}",
     "fileNotFoundRel": "File not found: {{relPath}}",
-    "notFoundFrom": "Not found: {{fromPath}}"
+    "notFoundFrom": "Not found: {{fromPath}}",
+    "alreadyExists": "Already exists: {{name}}"
   },
   "dns": {
     "needZoneServerIp": "Enter zone and server IP",
@@ -119,11 +158,24 @@
     "applyDigOk": "PowerDNS BIND: list-zones + dig OK",
     "applyDigFail": "Zone registered in conf but dig still empty/REFUSED — not marking applied",
     "applySyncIncomplete": "PowerDNS bind sync incomplete — zone file on disk only (not applied). Fix EXECUTE/root or pdns logs.",
-    "writeOnlyHint": "Zone file written only — PowerDNS will not answer until load/apply registers named"
+    "writeOnlyHint": "Zone file written only — PowerDNS will not answer until load/apply registers named",
+    "noActiveUnit": "No active named/bind9/pdns unit",
+    "pdnsUnitRestarts": "pdns unit state/restarts: {{detail}}",
+    "port53LoopbackOnly": "Port 53 is only on loopback (systemd-resolved 127.0.0.53) — not a product authoritative nameserver",
+    "port53Closed": "Port 53 is not listening (UDP/TCP)",
+    "udp53NotPublic": "UDP/53 is not listening on a public address",
+    "tcp53NotPublic": "TCP/53 is not listening on a public address",
+    "noManagedZones": "No managed zone files under dataDir/dns/zones",
+    "pdnsListZones": "PowerDNS list-zones: {{n}}",
+    "lookupIgnoredAt": "dig is unavailable — @{{server}} was ignored. Not using the system resolver as that server’s answer.",
+    "localAOk": "local A {{name}} → {{ip}}"
   },
   "db": {
     "needExecuteCreate": "Host execute is off; cannot create database from the panel",
-    "dryRunMysql": "dry-run: database not created. Use --execute with YSK_EXECUTE=1 to provision"
+    "dryRunMysql": "dry-run: database not created. Use --execute with YSK_EXECUTE=1 to provision",
+    "remoteNoCreds": "No username/password stored — TCP only (registration is not a login).",
+    "remoteReachable": "TCP {{host}}:{{port}} open ({{ms}}ms).",
+    "remoteUnreachable": "TCP {{host}}:{{port}} closed or filtered ({{ms}}ms)."
   },
   "net": {
     "invalidIface": "Invalid interface name",
@@ -204,7 +256,17 @@
     "dns": "DNS",
     "email": "Email",
     "isolation": "Project isolation",
-    "ops": "Operations"
+    "ops": "Operations",
+    "runtimesNode": "Node.js",
+    "runtimesPhp": "PHP",
+    "runtimesPython": "Python",
+    "runtimesGo": "Go",
+    "pm2": "PM2",
+    "runtimesNodeFix": "Install Node from /runtimes/node",
+    "runtimesPhpFix": "Install PHP from /runtimes/php",
+    "runtimesPythonFix": "Install Python from /runtimes/python",
+    "runtimesGoFix": "Install Go from /runtimes/go",
+    "pm2Fix": "Install PM2 from the Node runtime page"
   },
   "needAdmin": "Administrator permission required",
   "notInstalled": "Not installed",
@@ -215,6 +277,44 @@
   "probe": "Probe",
   "install": "Install",
   "port": "Port",
+  "git": {
+    "missingBin": "git is not on PATH",
+    "auth": "Authentication failed. Add a deploy key or HTTPS token.",
+    "hostkey": "SSH host key verification failed. Confirm and pin the host key.",
+    "dirty": "Working tree has {{count}} local change(s). Pull is blocked.",
+    "diverged": "Cannot fast-forward. Reset to the remote ref if you intend to discard local Git history.",
+    "missingRef": "That branch, tag, or commit is not on the remote.",
+    "shallow": "This clone is shallow. Fetch full history before pinning an old commit.",
+    "notRepo": "app/ is not a Git repository yet.",
+    "diffEmpty": "No unstaged diff (protected .env is excluded).",
+    "unrelated": "Unrelated histories. Reclone only after confirm — custom files will be lost.",
+    "lock": "Git index.lock is present. Remove it only if no git process is running.",
+    "disk": "Disk full or quota exceeded.",
+    "timeout": "Git timed out.",
+    "network": "Network error talking to the remote.",
+    "lfs": "This repo uses Git LFS and git-lfs is not available.",
+    "submodule": "Submodule update failed.",
+    "unknown": "Git failed. See the command output.",
+    "fetchOk": "Fetched from origin.",
+    "checkoutOk": "Checked out {{ref}}.",
+    "resetOk": "Reset hard to {{ref}}.",
+    "envRestored": "Restored app/.env from the control plane.",
+    "needPinHost": "SSH host key is not pinned. Scan and pin it before clone or fetch.",
+    "tokenSaved": "HTTPS token stored (never shown again).",
+    "tokenCleared": "HTTPS token removed.",
+    "tokenInvalid": "Token must be at least 8 characters.",
+    "deployKeyCreated": "Deploy key created. Add the public key on the Git host.",
+    "deployKeyCleared": "Deploy key detached from this project.",
+    "hostPinned": "Pinned SSH host keys for {{host}}.",
+    "hostUnpinned": "Cleared pinned SSH host keys.",
+    "hostScanFailed": "ssh-keyscan returned no keys for that host.",
+    "hookEnabled": "Inbound Git hook is on. Paste the URL into GitHub, Gitea, or GitLab yourself.",
+    "hookDisabled": "Inbound Git hook is off. The URL will not sync.",
+    "hookSecretOnce": "Copy this hook secret now. It is not shown again.",
+    "refsNeedUrl": "Enter a Git URL first.",
+    "refsOk": "Loaded {{branches}} branch(es) and {{tags}} tag(s).",
+    "refsEmpty": "Remote advertised no branches or tags."
+  },
   "auto": {
     "n0001": "Status: applied",
     "n0002": "User not found",
@@ -477,7 +577,7 @@
     "n0259": "domain",
     "n0260": "domain Not found:",
     "n0261": "dovecot reload failed or servicenot (sieve Wrote; reload Success)",
-    "n0262": "dry-run fleet dispatch (not )",
+    "n0262": "dry-run fleet dispatch (not queued)",
     "n0263": "dry-run peer push (not scp)",
     "n0264": "dry-run remote install (not ssh)",
     "n0265": "dry-run transfer done ( full bootstrap)",
@@ -486,10 +586,10 @@
     "n0268": "dry-run — not write /etc",
     "n0269": "dry-run: add --execute firstapply ufw",
     "n0270": "dry-run: inventory + preflight passed, not package/transfer",
-    "n0271": "dry-run: probe/. add --execute YSK_EXECUTE=1 firstreally provision",
-    "n0272": "dry-run: Wrote managed file (dataDir). add execute + YSK_EXECUTE=1 + root firstsystem drop-in",
-    "n0273": "dry-run: not. add --execute YSK_EXECUTE=1 firstreally ban",
-    "n0274": "dry-run: not. add --execute YSK_EXECUTE=1 firstreally unban",
+    "n0271": "Dry-run: probe/plan only. Pass --execute with YSK_EXECUTE=1 to actually provision.",
+    "n0272": "Dry-run: wrote the managed file (dataDir). Pass --execute with YSK_EXECUTE=1 as root to install the system drop-in.",
+    "n0273": "Dry-run: not banned. Pass --execute with YSK_EXECUTE=1 to actually ban.",
+    "n0274": "Dry-run: not unbanned. Pass --execute with YSK_EXECUTE=1 to actually unban.",
     "n0275": "dryRun=true — change API",
     "n0276": "dryRun: not write",
     "n0277": "dump Wrote dataDir, not transfer",
@@ -599,7 +699,7 @@
     "n0381": "post-transfer reapply",
     "n0382": "post-transfer restore",
     "n0383": "postconf not message_rate_limit (complete applied)",
-    "n0384": "postgres-replica Supports postgres",
+    "n0384": "kind postgres-replica needs --engine postgres",
     "n0385": "postgres_databases name",
     "n0386": "postqueue unavailable or mailNot installed",
     "n0387": "Install nginx on the host, or use panel software / runtime install",
@@ -768,7 +868,7 @@
     "n0550": "128M, 256M, 512M, -1 ()",
     "n0551": "e.g. 512MiB; leave empty to unset",
     "n0552": "900 1 300 10; disable",
-    "n0553": ": --member 10.0.0.3=replica:fleet:SESSION_UUID",
+    "n0553": "Paste a session UUID from /agents on the cluster form, or CLI --member 10.0.0.3=replica:fleet:SESSION_UUID",
     "n0554": "= ASN (system), not",
     "n0555": "22/80/443; can offnot port",
     "n0556": "kept: 10",
@@ -838,7 +938,7 @@
     "n0620": "startprocessnot process",
     "n0621": "OPcache",
     "n0622": "SSL",
-    "n0623": "",
+    "n0623": "Active",
     "n0624": "file",
     "n0625": "file",
     "n0626": "node wsrep, HA ≥2 node",
@@ -865,7 +965,7 @@
     "n0647": "intern (MB)",
     "n0648": "password",
     "n0649": "Error, please apply",
-    "n0650": "Security → My security → enable 2FA; policy may set requireAdminTotp",
+    "n0650": "Enable admin 2FA under Security → My security, then add a backup admin on Users.",
     "n0651": "and path",
     "n0652": "install PAM",
     "n0653": "install vsftpd",
@@ -1054,7 +1154,7 @@
     "n0836": "certificateplease Failed",
     "n0837": "≥ file",
     "n0838": "settingskeptbackup",
-    "n0839": "Successthis target can BatchMode, ≠",
+    "n0839": "Success means this target accepts BatchMode SSH (non-interactive). It is not a grant of global access.",
     "n0840": "or 32767",
     "n0841": "softwareInstalled",
     "n0842": "permission/",
@@ -1214,7 +1314,7 @@
     "n0996": "local nginx -t OK ( managed conf, ≠ edge applied)",
     "n0997": "local wsrep can, size not node",
     "n0998": "local ysk.json cannotread / fingerprint",
-    "n0999": "local OK; complete healthy peer probe (not )",
+    "n0999": "Local node is OK; a complete healthy status needs a peer probe (not done).",
     "n1000": "local nginx — conf Wrote, not reload",
     "n1001": "localAvailable NM connection; willSuccess. can \"\" or NetworkManager.",
     "n1002": "localAvailable ps — cannot ()",
@@ -1340,7 +1440,7 @@
     "n1120": "domain — map for (systemapplywill postmap )",
     "n1121": "IP",
     "n1122": "Available auto-ban enrich",
-    "n1123": "cannot ban to system: YSK_EXECUTE; to panel ban",
+    "n1123": "Cannot ban on the host: YSK_EXECUTE is off. The panel list was not changed.",
     "n1124": "cannot dump Redis: redis-cli",
     "n1125": "cannot dump: serverHost execute is not enabled",
     "n1126": "cannot fan-out: Host execute is not enabled",
@@ -1390,7 +1490,7 @@
     "n1170": "cannot from npm or GitHub version (not )",
     "n1171": "cannotprobe systemctl",
     "n1172": "cannot DNS cluster: Host execute is not enabled",
-    "n1173": "cannot: Host execute is not enabled (backupSuccess)",
+    "n1173": "Host execute is off. Live SFTP/S3/local probe needs YSK_EXECUTE=1.",
     "n1174": "cannot metrics",
     "n1175": "cannot: serverHost execute is not enabled",
     "n1176": "cannot ACME: Host execute is not enabled",
@@ -1810,7 +1910,7 @@
     "n1590": "",
     "n1591": "Not root — useradd / systemd / nginx system paths are restricted",
     "n1592": "not seccomp requires runAsUser",
-    "n1593": "panelplease /",
+    "n1593": "Public requests / min",
     "n1594": "panelconnection; Available\"\" ( )",
     "n1595": "Panel is not running as root",
     "n1596": "Available apply:false",
@@ -1828,6 +1928,8 @@
     "n1608": "verifyinvalid",
     "n1609": "passed",
     "n1610": "Package index not refreshed (YSK_EXECUTE off) — showing apt list only; enable execute to run apt-get update",
+    "n1611": "UFW is inactive: {{n}} permanent deny rule(s) are stored in user.rules but the kernel is not enforcing them.",
+    "n1612": "UFW is inactive. A deny rule would be written to user.rules only — the kernel would not drop packets. Enable UFW first. Not enabling automatically.",
     "t0001": "listenPort invalid: {{v0}}",
     "t0002": "restoreversion {{v0}}",
     "t0003": "file (>{{v0}} bytes)",
@@ -2081,7 +2183,7 @@
     "t0251": "{{v0}} Install incomplete",
     "t0252": "{{v0}} servicestart",
     "t0253": "Start failed: {{v0}}",
-    "t0254": "Supports Node.js version {{v0}}; Availableversion: {{v1}}",
+    "t0254": "Supports Node.js version {{v0}}; available versions: {{v1}}",
     "t0255": "Supports PHP version {{v0}}; Available: {{v1}}",
     "t0256": "Supports Python version {{v0}}; Available: {{v1}}",
     "t0257": "Supports Go version {{v0}}; Available: {{v1}}",
@@ -2158,7 +2260,7 @@
     "t0328": "projectdirectory: {{v0}}",
     "t0329": "tar failed: {{v0}}",
     "t0330": "Wrotebackup {{v0}}",
-    "t0331": "dry-run: file {{v0}}+ ( {{v1}})",
+    "t0331": "Preview: {{v0}} files in the archive (showing {{v1}})",
     "t0332": "cannot: {{v0}}",
     "t0333": "restore (web) to {{v0}}",
     "t0334": "web restoreFailed: {{v0}}",
@@ -2203,20 +2305,20 @@
     "t0373": "Project \"{{v0}}\" isolation",
     "t0374": "to localpath {{v0}}",
     "t0375": "identity {{v0}}: {{v1}}",
-    "t0376": "scp (identity) to {{v0}}",
-    "t0377": "scp(identity) failed: {{v0}}",
-    "t0378": "scp to {{v0}}",
-    "t0379": "scp failed: {{v0}}",
-    "t0380": "scp to {{v0}}",
-    "t0381": "scp Failed: {{v0}} ( backup remote identityId)",
+    "t0376": "sftp (identity) to {{v0}} ok",
+    "t0377": "sftp (identity) failed: {{v0}}",
+    "t0378": "sftp to {{v0}} ok",
+    "t0379": "sftp failed: {{v0}}",
+    "t0380": "sftp to {{v0}} ok",
+    "t0381": "sftp failed: {{v0}} (set backup remote identityId)",
     "t0382": "S3 {{v0}}",
     "t0383": "S3 failed: {{v0}}",
     "t0384": ": {{v0}}/{{v1}} admin Enabled 2FA",
-    "t0385": "Policy not enforced: {{v0}}/{{v1}} admin(s) have 2FA enabled",
+    "t0385": "Policy not enforced: {{v0}}/{{v1}} admin(s) have 2FA. If there is a single admin without 2FA, enable 2FA then add a backup admin.",
     "t0386": "{{v0}} PATH",
     "t0387": "{{v0}} not found",
     "t0388": "Install {{v0}} or add it to PATH",
-    "t0389": "Availableversion: {{v0}}",
+    "t0389": "Available versions: {{v0}}",
     "t0390": "{{v0}}% ( {{v1}} MB)",
     "t0391": "{{v0}}% ({{v1}})",
     "t0392": "servicestart {{v0}}",
@@ -2456,18 +2558,18 @@
     "t0626": "transfer: home rsync Failed {{v0}}",
     "t0627": "skipped: {{v0}}",
     "t0628": "transfer done → {{v0}}:{{v1}}",
-    "t0629": "project {{v0}} home: {{v1}}",
+    "t0629": "Project {{v0}} has no system user yet (home missing: {{v1}}). Finish isolation on the project page.",
     "t0630": "project {{v0}} bind_ip={{v1}} — can ( IP )",
     "t0631": "project {{v0}} home not path: {{v1}}",
-    "t0632": "home (store ): {{v0}}",
+    "t0632": "Orphan home on disk (no matching store project): {{v0}}",
     "t0633": "Maildir: {{v0}}",
     "t0634": "{{v0}} — cannot to target",
     "t0635": "cannotprobe {{v0}}",
     "t0636": "{{v0}} · {{v1}}",
     "t0637": "project {{v0}} · {{v1}} · DB {{v2}} · Redis {{v3}}",
-    "t0638": "installsoftware {{v0}} · homes {{v1}}",
+    "t0638": "Install software {{v0}} · homes {{v1}}",
     "t0639": "cutover host {{v0}}",
-    "t0640": "Warning {{v0}} (please )",
+    "t0640": "{{v0}} warning(s) — review before cutover.",
     "t0641": "key {{v0}}",
     "t0642": "cannotkey: {{v0}}",
     "t0643": "targetnot write authorized_keys: {{v0}}",
@@ -2531,7 +2633,7 @@
     "t0701": "CDN {{v0}}",
     "t0702": "origin shield Node does not exist: {{v0}}",
     "t0703": "edges: {{v0}}",
-    "t0704": "origin URL (): {{v0}}",
+    "t0704": "Origin URL (from project bind): {{v0}}",
     "t0705": "update CDN {{v0}}",
     "t0706": "create CDN {{v0}}",
     "t0707": "origin shield: edge shield {{v0}} → {{v1}}",
@@ -2627,7 +2729,14 @@
     "t0797": "timezone failed: {{v0}}",
     "tScoreFrom": "score={{score}} from={{from}}",
     "appliedTag": " (applied)",
-    "writtenTag": " (written only)"
+    "writtenTag": " (written only)",
+    "selfDestMissing": "Cannot find the running install directory (systemd ExecStart or cli.js)",
+    "selfDestUnwritable": "Cannot write to the running install directory {{v0}}",
+    "selfApplied": "Applied {{v0}} onto {{v1}}",
+    "selfVerifyFail": "Version file after overlay does not contain {{v0}}",
+    "selfDownloadFail": "Cannot download or unpack official package {{v0}}: {{v1}}",
+    "selfOverlayFail": "Could not overlay the official package onto the running install: {{v0}}",
+    "selfUpgradeHint": "Panel apply failed. As root run: curl -fsSL https://raw.githubusercontent.com/yanshekki/ysk-server/main/install.sh | bash -s -- --upgrade"
   },
   "tpl": {
     "deleted": "Deleted {{name}}",
@@ -2690,7 +2799,7 @@
     "noParen": "(none)",
     "keepOldDb": "(kept old DB)",
     "ufwNotDetected": "UFW not detected on this host",
-    "fail2banStartHint": "Start it on the Fail2ban page",
+    "fail2banStartHint": "Start it on the fail2ban page",
     "hasExecuteNotRoot": "EXECUTE is on but process is not root",
     "notRootTarget": "Not root (target useradd/apt will be blocked)",
     "reapplyDone": "reapply key steps completed",
@@ -2819,6 +2928,8 @@
     "openvpnComing": "OpenVPN full path is staged for the next release.",
     "outlineComing": "Outline / Shadowsocks is staged for a later release.",
     "needExecuteServer": "VPN server setup requires root and YSK_EXECUTE=1.",
+    "serverStopped": "{{engine}} server stopped.",
+    "serverStopFailed": "Could not stop {{engine}} server: {{detail}}",
     "needExecuteClient": "VPN client connect requires root and YSK_EXECUTE=1.",
     "keygenFailed": "WireGuard key generation failed (is wg installed?).",
     "serverKeysCreated": "WireGuard server keys created.",
@@ -2828,6 +2939,7 @@
     "peerCreated": "Client «{{name}}» created.",
     "peerNotFound": "Client not found.",
     "peerRemoved": "Client removed.",
+    "peersSynced": "Peer list reloaded on the running WireGuard interface.",
     "setEndpointHint": "Set public endpoint (host:port) so mobile clients can reach this server.",
     "invalidConf": "Conf must include [Interface] and PrivateKey.",
     "clientImported": "Profile «{{name}}» imported.",
@@ -2863,6 +2975,15 @@
     "needInstall": "Install {{stack}}",
     "needExecute": "YSK_EXECUTE is disabled — cannot install packages or provision Linux users.",
     "needRoot": "Not running as root — system useradd and vncserver apply are blocked.",
+    "hostnameResolves": "Hostname {{hostname}} resolves.",
+    "hostnameUnresolvable": "This host cannot resolve its own hostname ({{hostname}}). VNC session start will fail until /etc/hosts is fixed.",
+    "hostnameAlreadyResolves": "Hostname {{hostname}} already resolves — /etc/hosts unchanged.",
+    "hostnameWouldAppend": "Would append to /etc/hosts: {{line}}",
+    "hostnameAppended": "Appended to /etc/hosts: {{line}}",
+    "hostnameAppendFailed": "Could not write /etc/hosts: {{detail}}",
+    "hostnameAliasPresent": "Hostname {{hostname}} is already an exact /etc/hosts alias — not appended again.",
+    "hostnameStillUnresolvable": "Wrote /etc/hosts but {{hostname}} still does not resolve. Confirm nsswitch hosts includes files.",
+    "skipStartHostname": "Did not start the display — fix hostname resolution first.",
     "novncAssetsOnly": "noVNC web assets found; websockify binary still missing.",
     "viewerNeedExecute": "Starting a local VNC desktop for browser view needs root + YSK_EXECUTE",
     "browserSessionReady": "Browser VNC session ready: {{name}}",
@@ -2896,10 +3017,12 @@
     "userdelBlocked": "Cannot remove Linux user {{user}} without root + YSK_EXECUTE",
     "userAlreadyGone": "Linux user {{user}} already absent",
     "userdelFailed": "userdel failed for {{user}}: {{detail}}",
+    "userdelLeftover": "Panel account removed, but Linux user {{user}} is still on the host. Remove it from Users or the host.",
     "userDeleted": "Removed Linux user {{user}}",
     "passwordTooShort": "VNC password must be at least 6 characters",
     "passwordWrittenOnly": "Password marked in control plane only (need root + YSK_EXECUTE for vncpasswd)",
     "passwordFailed": "Failed to write VNC password: {{detail}}",
+    "passwordNeedTiger": "vncpasswd not found. Install TigerVNC (tigervnc-standalone-server) before setting a password.",
     "passwordSet": "VNC password set for {{user}}",
     "passwordUpdated": "Password updated for {{name}}",
     "passwordMetaOnly": "Password stored as meta only until system apply",
@@ -2909,6 +3032,7 @@
     "xstartupWritten": "Wrote {{path}}",
     "sessionStartBlocked": "Cannot start VNC session without root + YSK_EXECUTE",
     "sessionStartFailed": "Failed to start display :{{display}}: {{detail}}",
+    "sessionStartHostname": "Failed to start display :{{display}}: this host cannot resolve its own hostname. Add the hostname to /etc/hosts (or fix DNS) then start the session again.",
     "sessionStarted": "Started VNC for {{user}} on :{{display}} (port {{port}})",
     "sessionStartUnverified": "Start command returned OK but RFB port not yet listening",
     "sessionAlreadyRunning": "VNC already running for {{user}} on :{{display}} (port {{port}})",
@@ -2951,7 +3075,9 @@
     "clientDeleted": "Client profile deleted",
     "sessionStartCwd": "VNC start failed: working directory not accessible to the session user (display :{{display}}). Fixed by starting from HOME.",
     "desktopRestarted": "Desktop profile applied and session restarted ({{desktop}}). Reconnect VNC/noVNC.",
-    "desktopNeedsStart": "Desktop profile {{desktop}} written to xstartup. Start the session to apply."
+    "desktopNeedsStart": "Desktop profile {{desktop}} written to xstartup. Start the session to apply.",
+    "linuxUserRolledBack": "Removed leftover Linux user {{user}} after VNC password failed.",
+    "linuxUserOrphan": "Could not remove leftover Linux user {{user}} after VNC password failed."
   },
   "apache": {
     "needServerName": "Server name required",
@@ -3001,6 +3127,71 @@
     "startedDetached": "BT tracker detached worker started (pid {{pid}}, port {{port}})",
     "runningDetached": "Tracker running as detached worker (pid {{pid}})",
     "jobQueued": "BT torrent creation queued (large share)",
-    "jobRunning": "BT torrent creation running"
+    "jobRunning": "BT torrent creation running",
+    "libraryAdded": "Added {{name}} to the WebTorrent library",
+    "libraryInspectFailed": "Could not read that .torrent or magnet",
+    "libraryDup": "That torrent is already in the library",
+    "libraryDestBad": "Save folder is not a valid Files path",
+    "libraryTorrentTooBig": ".torrent file is larger than 8 MiB",
+    "libraryNotFound": "Library item not found",
+    "libraryPaused": "Paused",
+    "libraryResumed": "Resumed",
+    "libraryRemoved": "Removed from library",
+    "libraryFilesRemoved": "Deleted downloaded files",
+    "libraryRestoreDone": "Library restore: started {{started}}/{{attempted}} (failed {{failed}})",
+    "applyTrackersDone": "Applied extra trackers to {{n}} live announce slots",
+    "libraryNeedServe": "Saved. Open the panel (ysk-server serve) so WebTorrent can download or seed.",
+    "libraryDestIsFile": "Cannot create a folder named {{name}} — a file with that name already exists.",
+    "librarySeedMissing": "No matching files in that folder to seed.",
+    "libraryWaitingPeers": "Waiting for peers. If the files are already on this host, add again and choose seed-existing."
+  },
+  "migrate": {
+    "orphanConfirm": "Type the exact leftover home path to confirm delete.",
+    "orphanStillInStore": "That home still belongs to a project in the store.",
+    "orphanMissing": "Path not on disk: {{path}}",
+    "orphanNeedExecute": "Would remove leftover {{path}}. Needs YSK_EXECUTE=1.",
+    "orphanRmFailed": "Could not remove leftover home: {{detail}}",
+    "orphanRemoved": "Removed leftover project home {{path}}."
+  },
+  "publicFiles": {
+    "liveConf": "Live Nginx conf: {{path}}",
+    "publicRoot": "Public root: {{path}}",
+    "confNameStale": "Conf file {{file}} does not match current server_name {{serverName}}. Re-apply public files to rewrite the name."
+  },
+  "leftover": {
+    "staleCliTitle": "Stale leftover CLI",
+    "staleCli": "Leftover CLI still present: {{path}} (running product {{version}}). PATH may prefer it. Remove with: rm -f {{path}}",
+    "apacheDefaultTitle": "Apache leftover default site",
+    "apacheDefault": "Apache 000-default is still enabled. That is the stock site file — it does not mean Apache is listening on public :80 (YSK Apache is expected on 127.0.0.1:8080). Overlay does not disable it. Apply Apache from the panel or hosting apache apply --execute.",
+    "nginxCatchAllTitle": "Nginx catch-all missing",
+    "nginxCatchAll": "ysk-000-default.conf is not in /etc/nginx/conf.d. Unknown SNI can fall through. Run projects nginx-sync --execute.",
+    "vsftpdTitle": "vsftpd unit failed",
+    "vsftpd": "vsftpd is failed. Overlay does not rewrite listen/listen_ipv6. Apply FTP from the panel.",
+    "dovecotTitle": "Dovecot TLS points at missing cert",
+    "dovecot": "Dovecot ssl_cert points at missing {{path}}. Overlay does not rewrite ssl=no. Apply mail TLS after issuing the cert, or apply email stack.",
+    "overlayDoesNotHeal": "Product overlay does not rewrite nginx, Apache, vsftpd, or Dovecot. Use the listed apply commands (root + YSK_EXECUTE=1).",
+    "executeStaleCli": "Pass --execute (root + YSK_EXECUTE=1) to remove stale CLI bins.",
+    "executeMissingTls": "Pass --execute (root + YSK_EXECUTE=1) to disable missing-cert TLS so vsftpd/Dovecot can start.",
+    "executeGeneric": "Pass --execute (root + YSK_EXECUTE=1) to apply leftover cleanup for the findings above.",
+    "staleCliRemoved": "Removed leftover CLI {{path}}.",
+    "staleCliRemoveFailed": "Could not remove leftover CLI {{path}}: {{detail}}",
+    "vsftpdSslOff": "Set vsftpd ssl_enable=NO because the FTPS certificate file is missing, then restarted vsftpd.",
+    "dovecotSslOff": "Set Dovecot ssl=no because {{path}} is missing, then restarted Dovecot.",
+    "readinessTitle": "Host leftovers after overlay",
+    "readinessClean": "No leftover Apache default, missing nginx catch-all, failed vsftpd, or stale CLI detected.",
+    "nginxRemoved": "Removed leftover nginx conf {{path}}.",
+    "nginxNotLeftover": "Not a leftover public-files conf — refuse delete.",
+    "nginxUnusedKeep": "000-default is unused, not leftover — not deleted.",
+    "nginxSystemCopy": "System copy still present: {{path}}. Needs YSK_EXECUTE + root to remove.",
+    "nginxReloadFailed": "nginx -t or reload failed after removing {{path}}."
+  },
+  "defense": {
+    "panelReqLabel": "Panel requests / min",
+    "panelReqExcluded": "Authenticated panel traffic — shown here, not counted in threat score",
+    "tcpOk": "TCP {{target}} reachable",
+    "tcpFail": "TCP {{target}} failed",
+    "dnsDegraded": "DNS path degraded",
+    "reqRateHigh": "Public request rate {{reqs}}/min ≥ {{threshold}}",
+    "ddosHeuristic": "High public request rate plus edge probe failure"
   }
 }