ysk-server-shared 1.1.0 → 1.1.9

package/locales/bn/validators.json

@@ -5,7 +5,8 @@
   "tab": {
     "nodes": "নোড",
     "disk": "ডিস্ক",
-    "about": "সম্পর্কে"
+    "about": "সম্পর্কে",
+    "stack": "Software"
   },
   "empty": {
     "title": "এখনও কোনো ভ্যালিডেটর নোড নেই",
@@ -23,7 +24,18 @@
     "autoClear": "ডিস্ক সংকট হলে সবচেয়ে বড় বন্ধ ইনস্ট্যান্স স্বয়ংক্রিয় খালি করুন (ডিফল্ট বন্ধ)",
     "autoClearRisk": "Destructive: the largest stopped instance is deleted without a further prompt. Default is off. Check audit / logs after it fires.",
     "autoClearConfirmTitle": "Enable auto-clear?",
-    "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again."
+    "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again.",
+    "fsUsed": "Filesystem used",
+    "leftoverTitle": "Leftover data ({{count}})",
+    "leftoverDesc": "Directories under the validators root that are not a store instance. Remove only after you confirm they are unused.",
+    "leftoverRemove": "Remove",
+    "leftoverRemoveTitle": "Delete leftover validator data?",
+    "leftoverRemoveDesc": "Permanently delete {{path}} from disk. This is not a listed node.",
+    "autoClearThreshold": "Trigger: filesystem use at or above 85%.",
+    "autoClearCandidate": "Current candidate: {{id}}",
+    "autoClearNone": "No stopped instance is a candidate right now.",
+    "browseRoot": "Open in file browser",
+    "leftoverEmpty": "No leftover instance directories"
   },
   "chain": {
     "eth": "Ethereum",
@@ -133,7 +145,8 @@
     "snapshotNear": "NEAR ডেটা মুছেছে; compose অফিসিয়াল genesis ও epoch sync দিয়ে আবার শুরু করবে",
     "nativePrune": "ক্লায়েন্ট-নেটিভ পরিষ্কার কমান্ড চালানো হয়েছে",
     "dryDelete": "Delete is dry-run. Pass --execute and YSK_EXECUTE=1.",
-    "deleted": "Node deleted"
+    "deleted": "Node deleted",
+    "leftoverRemoved": "Removed leftover {{path}}"
   },
   "create": "নোড তৈরি",
   "wizard": {
@@ -162,7 +175,27 @@
     "installConfirmTitle": "Install this node?",
     "installConfirmDesc": "{{chain}} · {{network}} · {{profile}}. About {{disk}} of disk. The image pull can take a long time.",
     "installC1": "Several gigabytes of images may be downloaded.",
-    "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically."
+    "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically.",
+    "lowDiskAcked": "Free disk is below the recommended size. You confirmed create anyway; sync may stop if the disk fills.",
+    "diskNeedNetwork": "Default (Minimal) for this network needs about {{need}} · free {{free}}",
+    "diskShortDetail": "Need {{need}} · free {{free}} · short {{short}}",
+    "needCustomPath": "Enter an absolute data path",
+    "previewId": "Node id",
+    "previewCompose": "Compose project",
+    "profileSeeAbout": "What each profile means is on the About tab.",
+    "dockerAbout": "Docker Engine is required to install and start nodes.",
+    "dockerAboutOk": "Docker Engine is installed.",
+    "dockerAboutMissing": "Docker Engine is not installed. Open Docker to install it.",
+    "rewriteCompose": "Rewrite compose",
+    "rewriteComposeTitle": "Rewrite compose.yml from the current adapter?",
+    "rewriteComposeDesc": "Overwrites the generated compose for {{id}} using the shipped flags for this chain.",
+    "chainMeta": "{{disk}} min · {{clients}} clients",
+    "profileHint": {
+      "minimal": "Smallest sync — light disk, not for staking.",
+      "pruned": "Keeps recent history only (Pruned). Smaller than archive, still usable for RPC.",
+      "validator-ready": "Sized for a staking validator. Needs more disk than Minimal.",
+      "rpc": "Public RPC node — not a staking validator."
+    }
   },
   "actions": {
     "detail": "বিস্তারিত",
@@ -261,6 +294,32 @@
     "stopped": "Stopped",
     "running": "Running",
     "syncing": "Syncing",
-    "error": "Error"
+    "error": "Error",
+    "starting": "Starting"
+  },
+  "profileHelp": {
+    "title": "Profiles",
+    "desc": "The four choices on wizard step 3 are mainly disk budget and role. Each chain shows its recommended size in the wizard. The panel never holds staking keys.",
+    "minimal": "Smallest disk. Use for testnets or a first install. Not a full history, and not for a live staking validator.",
+    "pruned": "Keeps recent chain state and drops older blocks (Pruned). More disk than Minimal, less than a full node. Use to follow the tip long-term.",
+    "validatorReady": "Reserves more disk so you can later attest or propose as a validator. Generate keys offline yourself. Being offline or misconfigured can lose stake.",
+    "rpc": "For this host or other services to query the chain. RPC listens on 127.0.0.1 by default and is not published to the internet."
+  },
+  "software": {
+    "engine": "Docker Engine",
+    "engineDesc": "Validator nodes run as Compose projects. Install Docker here if it is missing. Image prune stays on the Docker page.",
+    "client": "Client",
+    "image": "Image",
+    "present": "Local",
+    "local": "Pulled",
+    "missing": "Not pulled",
+    "size": "Size",
+    "usedBy": "Used by",
+    "unused": "No instance",
+    "pull": "Pull",
+    "pulling": "Pull {{ref}}",
+    "empty": "No pinned client images",
+    "emptyDesc": "The catalog is empty. This should not happen.",
+    "daemonDown": "Docker Engine is not running"
   }
 }

package/locales/bn/vnc.json

@@ -251,5 +251,12 @@
   "deleteKeepUserWarn": "The Linux user will stay on the host as an orphan. You must clean it up later.",
   "bindRfbLine": "RFB {{bind}} :{{port}}",
   "bindNovncLine": "noVNC 127.0.0.1:{{port}}",
-  "bindNovncHint": "noVNC listens on localhost. The desktop is reached through this panel, not the public internet, unless RFB bind is all interfaces."
+  "bindNovncHint": "noVNC listens on localhost. The desktop is reached through this panel, not the public internet, unless RFB bind is all interfaces.",
+  "hostnameBroken": "This host cannot resolve its own hostname ({{hostname}}). Session start will fail.",
+  "hostnameFix": "Write hostname to /etc/hosts",
+  "hostnameFixTitle": "Append this line to /etc/hosts?",
+  "hostnameFixDesc": "{{line}}",
+  "hostnameFixDone": "Hostname /etc/hosts updated",
+  "startAfterCreateBlocked": "Disabled until the hostname resolves",
+  "hostnameBrokenIdle": "Hostname {{hostname}} does not resolve on this host. Fix /etc/hosts before you create a session."
 }

package/locales/en/agents.json

@@ -3,6 +3,8 @@
   "body": "OpenClaw / Hermes / IonClaw install and supervision; all tool calls go through Allowlist and approval.",
   "status": {
     "running": "Running",
+    "activating": "Starting",
+    "stuck": "Start stuck",
     "connected": "Online",
     "registered": "Registered only",
     "stale": "Stale",
@@ -13,6 +15,9 @@
     "unknown": "Not probed",
     "fallback": "Unknown"
   },
+  "activatingStuckHint": "Activating longer than 5 minutes — treated as failed. Check journal.",
+  "noOnlineAgents": "No agents online",
+  "journal": "journal",
   "liveN": "{{count}} online",
   "registeredOnly": "Registered only",
   "awaitProbe": "Awaiting probe",

package/locales/en/apache.json

@@ -1,6 +1,7 @@
 {
   "pageDesc": "Apache sites (PHP projects + standalone)",
   "pillSites": "{{count}} sites",
+  "pillSitesSplit": "{{n}} sites · {{leftover}} leftover",
   "listTitle": "Sites ({{count}})",
   "emptyTitle": "No sites",
   "createSite": "+ Create site",
@@ -8,6 +9,7 @@
   "editTitle": "Edit site",
   "deleteTitle": "Delete site?",
   "deleteDesc": "Remove this Apache site?",
+  "stopSites": "{{n}} site(s) will stop answering HTTP.",
   "colServerName": "Server name",
   "colSource": "Source",
   "colKind": "Type",

package/locales/en/backups.json

@@ -114,8 +114,24 @@
   "cancel": "Cancel",
   "deleteFailed": "Delete failed",
   "deleted": "Deleted",
-  "deleteTitle": "Delete backup file?",
-  "deleteDesc": "Permanently delete {{name}}",
+  "deleteTitle": "Move backup to recycle bin?",
+  "deleteDesc": "Move {{name}} to the recycle bin. Permanent delete after 7 days.",
+  "tabTrash": "Recycle bin",
+  "trashTitle": "Recycle bin ({{count}})",
+  "trashSub": "Deleted archives stay here for 7 days, then they are removed permanently.",
+  "trashEmpty": "Recycle bin is empty",
+  "trashEmptyDesc": "Deleted backup files appear here for 7 days.",
+  "trashRestore": "Restore",
+  "trashPurge": "Delete forever",
+  "trashEmptyAll": "Empty recycle bin",
+  "trashExpires": "Expires {{at}}",
+  "trashPurgeTitle": "Permanently delete this backup?",
+  "trashPurgeDesc": "Permanently delete {{name}}. This cannot be undone.",
+  "trashEmptyTitle": "Empty recycle bin?",
+  "trashEmptyDescConfirm": "Permanently delete {{count}} archive(s). Type the count to confirm.",
+  "trashRestored": "Restored from recycle bin",
+  "trashPurged": "Permanently deleted",
+  "trashedOk": "Moved to recycle bin",
   "resticSafeTitle": "restic restore to safe directory?",
   "resticSafeDesc": "Restore {{snapshot}} to project {{project}} .restic-restore-* directory",
   "resticRestoreDone": "restic restore complete",

package/locales/en/btTracker.json

@@ -50,8 +50,11 @@
   "statsTorrents": "Torrents",
   "statsLibrary": "Library",
   "statsLibraryHint": "Torrents in the panel library / file shares",
-  "statsTrackerLeftover": "Leftover (not in library)",
-  "statsTrackerLeftoverHint": "Hashes the local tracker has announced that are not torrent-library rows. Extra announce URLs are on the Trackers tab.",
+  "statsTrackerLeftover": "Tracker hashes not in library",
+  "statsTrackerLeftoverHint": "Info-hashes the local tracker has announced that are not torrent-library rows. Listed on the Tracker tab.",
+  "leftoverHashesTitle": "Tracker leftover hashes",
+  "publicHostMissingLive": "Tracker is listening but public announce host is not set. Off-host peers cannot find this seed.",
+  "leftoverHashesHint": "Read-only. These announces are not library or share rows.",
   "statsPeers": "Peers",
   "statsAnnounces": "Announces",
   "statsAnnouncesHint": "Announce requests seen by the tracker process",

package/locales/en/cdn.json

@@ -32,7 +32,8 @@
   "statNodes": "Nodes",
   "hitNoStats": "No edge stats yet",
   "loopbackOriginBlocked": "Will not apply loopback origin {{url}} to a remote edge. Set a reachable origin first.",
-  "applyFailedHint": "Apply failed — see notes below",
+  "applyFailedHint": "Apply failed",
+  "applyFailedNoNote": "No stored reason. Re-apply to capture the error.",
   "applyStatus": {
     "draft": "Draft",
     "planned": "Planned",
@@ -42,6 +43,7 @@
     "partial": "Partial"
   },
   "statSites": "Sites",
+  "statApplyFailed": "Apply failed",
   "pillNodesSites": "{{n}} nodes · {{s}} sites",
   "statOnline": "Online",
   "statHit": "Hit rate",

package/locales/en/common.json

@@ -30,6 +30,7 @@
   "unavailable": "Not available right now",
   "retry": "Retry",
   "success": "Success",
+  "ok": "OK",
   "failed": "Failed",
   "blocked": "Cannot run",
   "status": "Status",

package/locales/en/cron.json

@@ -76,6 +76,7 @@
   "hostNoYsk": "not installed or no YSK entries",
   "pressInstall": "Registered jobs are not on the system crontab yet — click Install to system.",
   "jobsTab": "Jobs ({{count}})",
+  "jobsTabPending": "Jobs ({{count}}) · pending {{pending}}",
   "registeredJobs": "Registered jobs ({{count}})",
   "jobsSub": "Management entries · Install to system after changes",
   "addJob": "+ Add job",
@@ -136,6 +137,8 @@
   "noHostJobs": "No crontab jobs in this scope",
   "hostPartial": "Could not read every user crontab (root required)",
   "pendingInstall": "Pending install ({{count}})",
+  "pendingStale": "Not written to system crontab for {{days}} day(s) — it will not run.",
+  "willNotRun": "Not written to system crontab — will not run.",
   "hourRange": "Hour must be 0–23.",
   "minuteRange": "Minute must be 0–59.",
   "hoursCommon": "Common hours",

package/locales/en/dashboard.json

@@ -44,10 +44,12 @@
   "readinessCheck": "Readiness:",
   "prodOk": "Production ready",
   "notFullyReady": "Not fully ready",
+  "readinessBlocked": "{{n}} blocker(s)",
   "modeScore": "Mode {{mode}} · score {{ready}}/{{total}}",
   "mode": {
     "degraded": "degraded",
-    "production_capable": "production ready",
+    "production_capable": "EXECUTE + root",
+    "blocked": "blocked",
     "normal": "normal"
   },
   "details": "Details",

package/locales/en/db.json

@@ -146,6 +146,23 @@
     "title": "Cluster",
     "description": "Plan → write management files → apply → probe → distribute to peers / fleet. Default is dry-run (no host restart).",
     "redirectedFromCluster": "You were redirected here from /cluster. This is the database cluster tab.",
+    "notApplied": "Not applied",
+    "plannedAt": "Created {{when}}",
+    "clearStalePlans": "Clear stale plans",
+    "clearStalePlansTitle": "Delete stale planned clusters?",
+    "clearStalePlansDesc": "Deletes {{n}} planned/draft registration(s) older than 7 days. Does not apply or push. System conf is not touched.",
+    "landingTitle": "Database cluster",
+    "landingDesc": "All planned and applied database clusters on this host. Open an engine to create or apply.",
+    "landingNoneInstalled": "MySQL, MariaDB, PostgreSQL, and Redis are not installed. Install an engine first.",
+    "openEngine": "Open {{engine}}",
+    "overviewPill": "Clusters {{n}}",
+    "enginesInstalled": "Engines",
+    "plannedCount": "Planned",
+    "overviewList": "Clusters ({{count}})",
+    "overviewEmpty": "No cluster registrations yet.",
+    "engine": "Engine",
+    "kind": "Kind",
+    "members": "Members",
     "kindGalera": "Simple Galera",
     "kindMysqlReplica": "MySQL primary/replica",
     "kindPgReplica": "PostgreSQL streaming replica",

package/locales/en/dns.json

@@ -209,10 +209,14 @@
   "healthHealPdns": "Heal PowerDNS bind",
   "healNeedInstall": "PowerDNS is not installed — install it on the Software tab first",
   "applyNeedService": "DNS service is not running — start or install it before apply",
+  "goStartService": "Start DNS service",
+  "startBindHint": "If start returns to stopped, port 53 is often held by systemd-resolved. Use Heal bind below, then start again.",
   "deleteZoneNeedName": "Delete this zone — you will type the zone name to confirm",
   "healthHealPdnsHint": "Set local-address to public IP to avoid clashing with systemd-resolved on 0",
   "healthHealPdnsOk": "PowerDNS bound to {{ip}} and start attempted",
   "healthHealPdnsFailed": "PowerDNS heal failed",
+  "startProbeFailed": "Could not re-check DNS health after start",
+  "startNotListening": "PowerDNS start returned, but the unit is not answering on port 53",
   "aboutTitle": "DNS essentials",
   "aboutSub": "Zones first; records, cluster, and DNSSEC need a selected domain.",
   "aboutZonesTitle": "Zones and scope",

package/locales/en/docker.json

@@ -59,6 +59,7 @@
     "down": "Stopped",
     "running": "Running",
     "exited": "Exited",
+    "exitedCode": "Exited ({{n}})",
     "restarting": "Restarting",
     "restartingCount": "Restarting · {{n}} times",
     "paused": "Paused",

package/locales/en/email.json

@@ -111,6 +111,8 @@
   "healthScore": "Health score",
   "healthUnchecked": "Not checked yet",
   "healthUncheckedHint": "Live DNS / PTR / port 25 have not been probed yet.",
+  "healthPartialScore": "Partial {{n}}/100 (DNS only)",
+  "healthPartialHint": "DNS checklist only — live and blacklist not probed.",
   "deliverabilityScore": "Deliverability pack",
   "opendkimNoReload": "OpenDKIM has no reload — use restart after key or table changes.",
   "opendkimNoReloadTitle": "systemctl reload opendkim is not supported on this stack",
@@ -452,6 +454,7 @@
   "deleteMailboxC3": "System Dovecot/Postfix may still need cleanup",
   "deleteAliasTitle": "Delete alias/forward?",
   "deleteAliasDesc": "Deletes {{source}}.",
+  "deleteImpact": "{{mailboxes}} mailboxes · {{records}} DNS records · {{aliases}} aliases",
   "deleteDomainC1": "All mailboxes and aliases",
   "deleteDomainC2": "Control-plane DKIM, DNS suggestions, and flags",
   "deleteDomainC3": "Local dataDir/email directory if present",

package/locales/en/files.json

@@ -102,6 +102,7 @@
   "webdavAfterEnable": "Available after you enable WebDAV and issue a token.",
   "webdavOn": "Enabled",
   "webdavOff": "Disabled",
+  "webdavOffNoToken": "Disabled (no active token)",
   "webdavTokenId": "Token #{{id}}",
   "webdavTokenInactive": "Disabled — token #{{id}} is not active",
   "webdavUpdated": "Updated {{at}}",

package/locales/en/ftp.json

@@ -53,6 +53,22 @@
   "accountCount": "Accounts",
   "loginBanner": "Login banner",
   "sslDomain": "SSL domain",
+  "plaintextInsecure": "Cleartext FTP (no TLS) — insecure. Enable FTPS before exposing port 21.",
+  "plaintextPublicLive": "vsftpd is listening on a public address without FTPS. Credentials travel in the clear. Enable FTPS, bind to this host only, or confirm PLAINTEXT to keep this posture.",
+  "bindAddress": "Listen scope",
+  "bindAddressHint": "New installs bind to this host only. Public listen without FTPS needs a typed confirmation.",
+  "bindLocal": "This host only",
+  "bindLocalHint": "127.0.0.1 — fine without TLS for local tests",
+  "bindPublic": "Public",
+  "bindPublicHint": "All interfaces — enable FTPS or confirm PLAINTEXT",
+  "enableFtpsAndStart": "Enable FTPS and start",
+  "publicPlainNeedConfirm": "Public cleartext FTP needs a PLAINTEXT confirmation",
+  "plainConfirmTitle": "Start public FTP without FTPS?",
+  "plainConfirmDesc": "Port 21 will accept logins and data in the clear on the public address.",
+  "plainConfirmC1": "Usernames and passwords are visible on the network.",
+  "plainConfirmC2": "PASV will advertise the configured public IP.",
+  "plainConfirmC3": "Host firewall and cloud security group are not opened for you.",
+  "plainConfirmAction": "Start cleartext FTP",
   "pasvRange": "PASV range",
   "forceTls": "Force TLS",
   "allowWrite": "Allow write",

package/locales/en/hostBrowse.json

@@ -97,6 +97,8 @@
   "isolationNote": "Real browser creates an ephemeral Linux user for Chrome; leaving the page or idle timeout destroys that user.",
   "resumeHint": "Resume previous session ({{count}} tabs)",
   "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}",
+  "resumeHintOwned": "Resume last browse for {{user}} ({{count}} tabs) · {{url}} · {{when}}",
+  "clearSessionData": "Clear session data",
   "resume": "Resume",
   "resumeDismiss": "Dismiss",
   "resumeDone": "Session resumed",

package/locales/en/migrate.json

@@ -11,6 +11,8 @@
   "inventorying": "Inventorying",
   "inventoried": "Inventoried",
   "inventoriedWarn": "Inventoried · {{n}} warnings",
+  "inventoriedOrphans": "Inventoried · {{n}} leftover homes",
+  "inventoriedWarnAndOrphans": "Inventoried · {{w}} warnings · {{n}} leftover",
   "inventoryFailed": "Inventory failed",
   "pendingInventory": "Pending inventory",
   "projects": "Projects",
@@ -70,7 +72,18 @@
   "afterRestart": ") then Refresh.",
   "inventoryWarnings": "Inventory warnings ({{count}})",
   "orphanHomesHint": "Leftover project homes (not in the store). Remove only after you confirm they are unused.",
-  "orphanRemove": "Remove leftover home",
+  "orphanHomesTitle": "Leftover project homes ({{count}})",
+  "orphanHomesSummary": "{{count}} path(s) on disk are not in the store. Back up first if unsure, then remove unused paths.",
+  "orphanColHome": "Home",
+  "orphanColModified": "Modified",
+  "orphanColEntries": "Entries",
+  "orphanEntries": "{{n}} top-level entries in the directory",
+  "orphanKpi": "Leftover",
+  "sourceOs": "OS",
+  "sourceDataDir": "dataDir",
+  "sourceDbRedis": "Databases / Redis",
+  "sourceDbRedisValue": "{{db}} databases · {{redis}} Redis",
+  "orphanRemove": "Remove",
   "orphanRemoveTitle": "Delete leftover project home?",
   "orphanRemoveDesc": "Permanently delete {{path}} from disk. This is not a store project. Needs superuser and system-change permission.",
   "orphanRemovePhrase": "Type DELETE to confirm.",

package/locales/en/network.json

@@ -8,6 +8,8 @@
     "up": "Up",
     "down": "Down",
     "unknown": "Unknown",
+    "loopback": "Always on",
+    "loopbackHint": "Loopback is always available and cannot be changed.",
     "other": "Other"
   },
   "statGateway": "Gateway",

package/locales/en/nginx.json

@@ -5,6 +5,8 @@
   "purgeOk": "Purged",
   "projectSitesHint": "Project sites (managed conf) and standalone sites are listed separately. Edit project Nginx under Projects → Network.",
   "purgeCache": "Purge cache + reload",
+  "purgeCacheTitle": "Purge Nginx cache and reload?",
+  "purgeCacheDesc": "Clears the on-disk cache and reloads Nginx. Live sites stay up.",
   "notInstalled": "Nginx is not installed",
   "listTitle": "Sites ({{count}})",
   "listDesc": "After create, click Apply to sync to the system",
@@ -80,5 +82,6 @@
   "setHsts": "HSTS",
   "setCfRealIp": "Cloudflare Real IP",
   "setIndexes": "Directory listing",
-  "bodyInherit": "Global"
+  "bodyInherit": "Global",
+  "stopSites": "{{n}} site(s) will stop answering HTTP."
 }

package/locales/en/notes.json

@@ -1,4 +1,7 @@
 {
+  "agents": {
+    "activatingStuck": "systemd unit has been activating for more than 5 minutes — treating as failed. Check journal."
+  },
   "notFound": "Not found",
   "needPath": "Specify a path",
   "needName": "Enter a name",
@@ -65,10 +68,18 @@
     "targetOutside": "Restore target must be inside the project home or the public files root.",
     "controlPlaneDryRun": "Preview only — nothing written. In the panel, use Restore and confirm the phrase to write.",
     "controlPlaneNeedConfirm": "Full control-plane restore needs the confirm phrase RESTORE-CONTROL-PLANE.",
-    "controlPlaneRestartAfter": "Restart the API after a successful restore."
+    "controlPlaneRestartAfter": "Restart the API after a successful restore.",
+    "movedToTrash": "Moved {{name}} to the recycle bin. Permanent delete after {{days}} days.",
+    "restoreNameExists": "Cannot restore {{name}} — a live archive with that name already exists.",
+    "restoredFromTrash": "Restored {{name}} from the recycle bin.",
+    "trashEmptied": "Permanently deleted {{n}} archive(s) from the recycle bin."
   },
   "redis": {
-    "cliMissing": "redis-cli is not installed"
+    "cliMissing": "redis-cli is not installed",
+    "requirepassAlreadySet": "Redis already has requirepass — not overwritten.",
+    "requirepassApplied": "requirepass applied at runtime",
+    "requirepassApplyFailed": "Could not CONFIG SET requirepass (will rely on restart + conf)",
+    "generatedRequirepass": "Generated Redis password (shown once): {{password}}"
   },
   "nginx": {
     "reloaded": "nginx reloaded",
@@ -91,7 +102,8 @@
     "vsftpdStarted": "vsftpd started",
     "openPortsStep": "Firewall ports (manual)",
     "openPortsReminder": "Open TCP ports on host firewall and cloud security group: {{ports}}. FTPS apply does not open ports for you.",
-    "openPortsPasvHint": "If login works but directory LIST times out, the PASV data range is blocked — open the ful"
+    "openPortsPasvHint": "If login works but directory LIST times out, the PASV data range is blocked — open the ful",
+    "publicPlaintextBlocked": "Refusing to start public FTP without FTPS. Bind to this host only, enable FTPS with a certificate, or confirm PLAINTEXT to expose cleartext on the public address."
   },
   "deploy": {
     "nodeMissingIsolated": "Node binary missing for isolated deploy: {{path}} — install Node {{version}} toolchain then redeploy. Refusing to write a unit that would 203/EXEC.",
@@ -146,7 +158,17 @@
     "applyDigOk": "PowerDNS BIND: list-zones + dig OK",
     "applyDigFail": "Zone registered in conf but dig still empty/REFUSED — not marking applied",
     "applySyncIncomplete": "PowerDNS bind sync incomplete — zone file on disk only (not applied). Fix EXECUTE/root or pdns logs.",
-    "writeOnlyHint": "Zone file written only — PowerDNS will not answer until load/apply registers named"
+    "writeOnlyHint": "Zone file written only — PowerDNS will not answer until load/apply registers named",
+    "noActiveUnit": "No active named/bind9/pdns unit",
+    "pdnsUnitRestarts": "pdns unit state/restarts: {{detail}}",
+    "port53LoopbackOnly": "Port 53 is only on loopback (systemd-resolved 127.0.0.53) — not a product authoritative nameserver",
+    "port53Closed": "Port 53 is not listening (UDP/TCP)",
+    "udp53NotPublic": "UDP/53 is not listening on a public address",
+    "tcp53NotPublic": "TCP/53 is not listening on a public address",
+    "noManagedZones": "No managed zone files under dataDir/dns/zones",
+    "pdnsListZones": "PowerDNS list-zones: {{n}}",
+    "lookupIgnoredAt": "dig is unavailable — @{{server}} was ignored. Not using the system resolver as that server’s answer.",
+    "localAOk": "local A {{name}} → {{ip}}"
   },
   "db": {
     "needExecuteCreate": "Host execute is off; cannot create database from the panel",
@@ -2536,7 +2558,7 @@
     "t0626": "transfer: home rsync Failed {{v0}}",
     "t0627": "skipped: {{v0}}",
     "t0628": "transfer done → {{v0}}:{{v1}}",
-    "t0629": "project {{v0}} home: {{v1}}",
+    "t0629": "Project {{v0}} has no system user yet (home missing: {{v1}}). Finish isolation on the project page.",
     "t0630": "project {{v0}} bind_ip={{v1}} — can ( IP )",
     "t0631": "project {{v0}} home not path: {{v1}}",
     "t0632": "Orphan home on disk (no matching store project): {{v0}}",
@@ -2953,6 +2975,15 @@
     "needInstall": "Install {{stack}}",
     "needExecute": "YSK_EXECUTE is disabled — cannot install packages or provision Linux users.",
     "needRoot": "Not running as root — system useradd and vncserver apply are blocked.",
+    "hostnameResolves": "Hostname {{hostname}} resolves.",
+    "hostnameUnresolvable": "This host cannot resolve its own hostname ({{hostname}}). VNC session start will fail until /etc/hosts is fixed.",
+    "hostnameAlreadyResolves": "Hostname {{hostname}} already resolves — /etc/hosts unchanged.",
+    "hostnameWouldAppend": "Would append to /etc/hosts: {{line}}",
+    "hostnameAppended": "Appended to /etc/hosts: {{line}}",
+    "hostnameAppendFailed": "Could not write /etc/hosts: {{detail}}",
+    "hostnameAliasPresent": "Hostname {{hostname}} is already an exact /etc/hosts alias — not appended again.",
+    "hostnameStillUnresolvable": "Wrote /etc/hosts but {{hostname}} still does not resolve. Confirm nsswitch hosts includes files.",
+    "skipStartHostname": "Did not start the display — fix hostname resolution first.",
     "novncAssetsOnly": "noVNC web assets found; websockify binary still missing.",
     "viewerNeedExecute": "Starting a local VNC desktop for browser view needs root + YSK_EXECUTE",
     "browserSessionReady": "Browser VNC session ready: {{name}}",
@@ -3139,12 +3170,20 @@
     "dovecotTitle": "Dovecot TLS points at missing cert",
     "dovecot": "Dovecot ssl_cert points at missing {{path}}. Overlay does not rewrite ssl=no. Apply mail TLS after issuing the cert, or apply email stack.",
     "overlayDoesNotHeal": "Product overlay does not rewrite nginx, Apache, vsftpd, or Dovecot. Use the listed apply commands (root + YSK_EXECUTE=1).",
+    "executeStaleCli": "Pass --execute (root + YSK_EXECUTE=1) to remove stale CLI bins.",
+    "executeMissingTls": "Pass --execute (root + YSK_EXECUTE=1) to disable missing-cert TLS so vsftpd/Dovecot can start.",
+    "executeGeneric": "Pass --execute (root + YSK_EXECUTE=1) to apply leftover cleanup for the findings above.",
     "staleCliRemoved": "Removed leftover CLI {{path}}.",
     "staleCliRemoveFailed": "Could not remove leftover CLI {{path}}: {{detail}}",
     "vsftpdSslOff": "Set vsftpd ssl_enable=NO because the FTPS certificate file is missing, then restarted vsftpd.",
     "dovecotSslOff": "Set Dovecot ssl=no because {{path}} is missing, then restarted Dovecot.",
     "readinessTitle": "Host leftovers after overlay",
-    "readinessClean": "No leftover Apache default, missing nginx catch-all, failed vsftpd, or stale CLI detected."
+    "readinessClean": "No leftover Apache default, missing nginx catch-all, failed vsftpd, or stale CLI detected.",
+    "nginxRemoved": "Removed leftover nginx conf {{path}}.",
+    "nginxNotLeftover": "Not a leftover public-files conf — refuse delete.",
+    "nginxUnusedKeep": "000-default is unused, not leftover — not deleted.",
+    "nginxSystemCopy": "System copy still present: {{path}}. Needs YSK_EXECUTE + root to remove.",
+    "nginxReloadFailed": "nginx -t or reload failed after removing {{path}}."
   },
   "defense": {
     "panelReqLabel": "Panel requests / min",

package/locales/en/projects.json

@@ -60,6 +60,7 @@
   },
   "next": {
     "pendingOsTitle": "System user not provisioned",
+    "provisionOsAction": "Create system user",
     "pendingOsBody": "This project has no isolated system user yet.",
     "pendingOsActions": "You can still deploy; full isolation needs admin privileges on the host.",
     "deployTitle": "Next: Deploy",

package/locales/en/protection.json

@@ -250,6 +250,8 @@
   "unban": "Unban",
   "ban": "Ban",
   "banConfirmTitle": "Ban {{ip}}?",
+  "banConfirmMethod": "Method: {{method}}",
+  "banConfirmUntilUnban": "Stays banned until you unban it (or fail2ban expiry).",
   "banConfirmDesc": "This IP will be blocked on the host. Confirm it is not a current panel or session address.",
   "wlRemovedUndo": "Removed {{ip}} from the allow list. Undo within 5 seconds.",
   "undo": "Undo",

package/locales/en/publicFiles.json

@@ -41,5 +41,9 @@
   "publicRootNote": "Public root: {{path}}",
   "applyConfirmTitle": "Apply public-files site?",
   "applyConfirmDesc": "Write Nginx server_name {{name}} and reload Nginx.",
-  "serverNameMismatch": "Live conf uses {{live}}; the form has {{draft}}. Apply to replace."
+  "serverNameMismatch": "Live conf uses {{live}}; the form has {{draft}}. Apply to replace.",
+  "liveName": "Live name",
+  "draftName": "Draft name",
+  "draftUnapplied": "This draft is not applied. Nginx still serves the live name.",
+  "discardDraft": "Discard draft"
 }

package/locales/en/redis.json

@@ -73,6 +73,11 @@
   "noRequirepass": "Protected mode is on, but requirepass is empty or unread — no password.",
   "insecureShort": "No password",
   "setRequirepass": "Set password",
+  "generateRequirepass": "Generate and apply password",
+  "generateRequirepassTitle": "Generate a Redis password?",
+  "generateRequirepassDesc": "Writes requirepass and restarts Redis. The password is shown once. Host change needs EXECUTE.",
+  "generateRequirepassDone": "Redis password applied",
+  "generatedOnce": "Generated password (shown once): {{password}}",
   "rdbOnlyLossHint": "AOF is off and RDB is on. A restart or crash can lose recent writes.",
   "dirDataContainer": "/data (container)",
   "dirHostDefault": "/var/lib/redis",

package/locales/en/security.json

@@ -61,6 +61,8 @@
   "reauthPassword": "Re-enter password",
   "reauthPasswordHint": "Start/reset 2FA requires password again (stolen session protection)",
   "reauthPasswordRequired": "Enter your login password first",
+  "needCurrentPassword": "Enter the current password first",
+  "passwordMin8": "New password must be at least 8 characters",
   "totpSecretGenerated": "Secret ready — scan the QR or copy the key, then enter the app’s 6-digit code",
   "reset2fa": "Reset 2FA",
   "start2fa": "Set up 2FA",

package/locales/en/services.json

@@ -38,8 +38,10 @@
   "needRunning": "{{label}} is not running",
   "restartedOk": "{{label}} restarted",
   "reloadedOk": "{{label}} reloaded",
+  "reloadTitle": "Reload {{label}} configuration without a full restart",
   "stopNeedConfirm": "Needs confirmation",
   "stopNeedConfirmPhrase": "Needs confirmation phrase",
+  "stopNeedConfirmImpact": "Stop {{label}}? Active connections to this service will drop.",
   "stopConfirmTitle": "Stop {{label}}?",
   "stopConfirmDesc": "{{label}} will stop listening. Start it again from this page when needed.",
   "stopConfirmEdgeDesc": "Stopping {{label}} takes sites and reverse-proxy traffic offline until it is started again.",
@@ -50,8 +52,14 @@
   "stopConfirmSshdConsequence": "New SSH sessions will fail until sshd is started from the host console.",
   "stopConfirmPanelTitle": "Stop YSK Server?",
   "stopConfirmPanelDesc": "The panel and API will go offline until the unit is started on the host.",
+  "stopConfirmPanelSshdOffDesc": "The panel and API will go offline. sshd is not enabled on boot, so SSH may not be a rescue path after reboot.",
+  "stopConfirmPanelSshdOffConsequence": "sshd is not enabled on boot. After reboot you may have no SSH rescue path.",
+  "ufwNoLifecycle": "UFW is not started or stopped from this matrix.",
   "restartConfirmPanelTitle": "Restart YSK Server?",
   "restartConfirmPanelDesc": "The panel and API will drop briefly while the unit restarts.",
+  "restartConfirmTitle": "Restart {{label}}?",
+  "restartConfirmDesc": "Restart {{label}} now. Active connections may drop.",
+  "startVerifyFailed": "{{label}} start did not stay healthy.",
   "stopConfirmPanelToken": "stop ysk-server",
   "stopConfirmPanelConsequence": "This browser session will disconnect. Start the unit from SSH or the host console.",
   "stopConfirmFail2banTitle": "Stop fail2ban?",