ysk-server-shared 1.1.0 → 1.1.9

package/locales/en/translation.json

@@ -7,6 +7,8 @@
     "body": "OpenClaw / Hermes / IonClaw install and supervision; all tool calls go through Allowlist and approval.",
     "status": {
       "running": "Running",
+      "activating": "Starting",
+      "stuck": "Start stuck",
       "connected": "Online",
       "registered": "Registered only",
       "stale": "Stale",
@@ -17,6 +19,9 @@
       "unknown": "Not probed",
       "fallback": "Unknown"
     },
+    "activatingStuckHint": "Activating longer than 5 minutes — treated as failed. Check journal.",
+    "noOnlineAgents": "No agents online",
+    "journal": "journal",
     "liveN": "{{count}} online",
     "registeredOnly": "Registered only",
     "awaitProbe": "Awaiting probe",
@@ -206,6 +211,7 @@
   "apache": {
     "pageDesc": "Apache sites (PHP projects + standalone)",
     "pillSites": "{{count}} sites",
+    "pillSitesSplit": "{{n}} sites · {{leftover}} leftover",
     "listTitle": "Sites ({{count}})",
     "emptyTitle": "No sites",
     "createSite": "+ Create site",
@@ -213,6 +219,7 @@
     "editTitle": "Edit site",
     "deleteTitle": "Delete site?",
     "deleteDesc": "Remove this Apache site?",
+    "stopSites": "{{n}} site(s) will stop answering HTTP.",
     "colServerName": "Server name",
     "colSource": "Source",
     "colKind": "Type",
@@ -421,8 +428,24 @@
     "cancel": "Cancel",
     "deleteFailed": "Delete failed",
     "deleted": "Deleted",
-    "deleteTitle": "Delete backup file?",
-    "deleteDesc": "Permanently delete {{name}}",
+    "deleteTitle": "Move backup to recycle bin?",
+    "deleteDesc": "Move {{name}} to the recycle bin. Permanent delete after 7 days.",
+    "tabTrash": "Recycle bin",
+    "trashTitle": "Recycle bin ({{count}})",
+    "trashSub": "Deleted archives stay here for 7 days, then they are removed permanently.",
+    "trashEmpty": "Recycle bin is empty",
+    "trashEmptyDesc": "Deleted backup files appear here for 7 days.",
+    "trashRestore": "Restore",
+    "trashPurge": "Delete forever",
+    "trashEmptyAll": "Empty recycle bin",
+    "trashExpires": "Expires {{at}}",
+    "trashPurgeTitle": "Permanently delete this backup?",
+    "trashPurgeDesc": "Permanently delete {{name}}. This cannot be undone.",
+    "trashEmptyTitle": "Empty recycle bin?",
+    "trashEmptyDescConfirm": "Permanently delete {{count}} archive(s). Type the count to confirm.",
+    "trashRestored": "Restored from recycle bin",
+    "trashPurged": "Permanently deleted",
+    "trashedOk": "Moved to recycle bin",
     "resticSafeTitle": "restic restore to safe directory?",
     "resticSafeDesc": "Restore {{snapshot}} to project {{project}} .restic-restore-* directory",
     "resticRestoreDone": "restic restore complete",
@@ -509,8 +532,11 @@
     "statsTorrents": "Torrents",
     "statsLibrary": "Library",
     "statsLibraryHint": "Torrents in the panel library / file shares",
-    "statsTrackerLeftover": "Leftover (not in library)",
-    "statsTrackerLeftoverHint": "Hashes the local tracker has announced that are not torrent-library rows. Extra announce URLs are on the Trackers tab.",
+    "statsTrackerLeftover": "Tracker hashes not in library",
+    "statsTrackerLeftoverHint": "Info-hashes the local tracker has announced that are not torrent-library rows. Listed on the Tracker tab.",
+    "leftoverHashesTitle": "Tracker leftover hashes",
+    "publicHostMissingLive": "Tracker is listening but public announce host is not set. Off-host peers cannot find this seed.",
+    "leftoverHashesHint": "Read-only. These announces are not library or share rows.",
     "statsPeers": "Peers",
     "statsAnnounces": "Announces",
     "statsAnnouncesHint": "Announce requests seen by the tracker process",
@@ -721,7 +747,8 @@
     "statNodes": "Nodes",
     "hitNoStats": "No edge stats yet",
     "loopbackOriginBlocked": "Will not apply loopback origin {{url}} to a remote edge. Set a reachable origin first.",
-    "applyFailedHint": "Apply failed — see notes below",
+    "applyFailedHint": "Apply failed",
+    "applyFailedNoNote": "No stored reason. Re-apply to capture the error.",
     "applyStatus": {
       "draft": "Draft",
       "planned": "Planned",
@@ -731,6 +758,7 @@
       "partial": "Partial"
     },
     "statSites": "Sites",
+    "statApplyFailed": "Apply failed",
     "pillNodesSites": "{{n}} nodes · {{s}} sites",
     "statOnline": "Online",
     "statHit": "Hit rate",
@@ -2106,6 +2134,7 @@
     "unavailable": "Not available right now",
     "retry": "Retry",
     "success": "Success",
+    "ok": "OK",
     "failed": "Failed",
     "blocked": "Cannot run",
     "status": "Status",
@@ -2284,6 +2313,7 @@
     "hostNoYsk": "not installed or no YSK entries",
     "pressInstall": "Registered jobs are not on the system crontab yet — click Install to system.",
     "jobsTab": "Jobs ({{count}})",
+    "jobsTabPending": "Jobs ({{count}}) · pending {{pending}}",
     "registeredJobs": "Registered jobs ({{count}})",
     "jobsSub": "Management entries · Install to system after changes",
     "addJob": "+ Add job",
@@ -2344,6 +2374,8 @@
     "noHostJobs": "No crontab jobs in this scope",
     "hostPartial": "Could not read every user crontab (root required)",
     "pendingInstall": "Pending install ({{count}})",
+    "pendingStale": "Not written to system crontab for {{days}} day(s) — it will not run.",
+    "willNotRun": "Not written to system crontab — will not run.",
     "hourRange": "Hour must be 0–23.",
     "minuteRange": "Minute must be 0–59.",
     "hoursCommon": "Common hours",
@@ -2420,10 +2452,12 @@
     "readinessCheck": "Readiness:",
     "prodOk": "Production ready",
     "notFullyReady": "Not fully ready",
+    "readinessBlocked": "{{n}} blocker(s)",
     "modeScore": "Mode {{mode}} · score {{ready}}/{{total}}",
     "mode": {
       "degraded": "degraded",
-      "production_capable": "production ready",
+      "production_capable": "EXECUTE + root",
+      "blocked": "blocked",
       "normal": "normal"
     },
     "details": "Details",
@@ -2656,6 +2690,23 @@
       "title": "Cluster",
       "description": "Plan → write management files → apply → probe → distribute to peers / fleet. Default is dry-run (no host restart).",
       "redirectedFromCluster": "You were redirected here from /cluster. This is the database cluster tab.",
+      "notApplied": "Not applied",
+      "plannedAt": "Created {{when}}",
+      "clearStalePlans": "Clear stale plans",
+      "clearStalePlansTitle": "Delete stale planned clusters?",
+      "clearStalePlansDesc": "Deletes {{n}} planned/draft registration(s) older than 7 days. Does not apply or push. System conf is not touched.",
+      "landingTitle": "Database cluster",
+      "landingDesc": "All planned and applied database clusters on this host. Open an engine to create or apply.",
+      "landingNoneInstalled": "MySQL, MariaDB, PostgreSQL, and Redis are not installed. Install an engine first.",
+      "openEngine": "Open {{engine}}",
+      "overviewPill": "Clusters {{n}}",
+      "enginesInstalled": "Engines",
+      "plannedCount": "Planned",
+      "overviewList": "Clusters ({{count}})",
+      "overviewEmpty": "No cluster registrations yet.",
+      "engine": "Engine",
+      "kind": "Kind",
+      "members": "Members",
       "kindGalera": "Simple Galera",
       "kindMysqlReplica": "MySQL primary/replica",
       "kindPgReplica": "PostgreSQL streaming replica",
@@ -3069,10 +3120,14 @@
     "healthHealPdns": "Heal PowerDNS bind",
     "healNeedInstall": "PowerDNS is not installed — install it on the Software tab first",
     "applyNeedService": "DNS service is not running — start or install it before apply",
+    "goStartService": "Start DNS service",
+    "startBindHint": "If start returns to stopped, port 53 is often held by systemd-resolved. Use Heal bind below, then start again.",
     "deleteZoneNeedName": "Delete this zone — you will type the zone name to confirm",
     "healthHealPdnsHint": "Set local-address to public IP to avoid clashing with systemd-resolved on 0",
     "healthHealPdnsOk": "PowerDNS bound to {{ip}} and start attempted",
     "healthHealPdnsFailed": "PowerDNS heal failed",
+    "startProbeFailed": "Could not re-check DNS health after start",
+    "startNotListening": "PowerDNS start returned, but the unit is not answering on port 53",
     "aboutTitle": "DNS essentials",
     "aboutSub": "Zones first; records, cluster, and DNSSEC need a selected domain.",
     "aboutZonesTitle": "Zones and scope",
@@ -3153,6 +3208,7 @@
       "down": "Stopped",
       "running": "Running",
       "exited": "Exited",
+      "exitedCode": "Exited ({{n}})",
       "restarting": "Restarting",
       "restartingCount": "Restarting · {{n}} times",
       "paused": "Paused",
@@ -3452,6 +3508,8 @@
     "healthScore": "Health score",
     "healthUnchecked": "Not checked yet",
     "healthUncheckedHint": "Live DNS / PTR / port 25 have not been probed yet.",
+    "healthPartialScore": "Partial {{n}}/100 (DNS only)",
+    "healthPartialHint": "DNS checklist only — live and blacklist not probed.",
     "deliverabilityScore": "Deliverability pack",
     "opendkimNoReload": "OpenDKIM has no reload — use restart after key or table changes.",
     "opendkimNoReloadTitle": "systemctl reload opendkim is not supported on this stack",
@@ -3793,6 +3851,7 @@
     "deleteMailboxC3": "System Dovecot/Postfix may still need cleanup",
     "deleteAliasTitle": "Delete alias/forward?",
     "deleteAliasDesc": "Deletes {{source}}.",
+    "deleteImpact": "{{mailboxes}} mailboxes · {{records}} DNS records · {{aliases}} aliases",
     "deleteDomainC1": "All mailboxes and aliases",
     "deleteDomainC2": "Control-plane DKIM, DNS suggestions, and flags",
     "deleteDomainC3": "Local dataDir/email directory if present",
@@ -4125,6 +4184,7 @@
     "webdavAfterEnable": "Available after you enable WebDAV and issue a token.",
     "webdavOn": "Enabled",
     "webdavOff": "Disabled",
+    "webdavOffNoToken": "Disabled (no active token)",
     "webdavTokenId": "Token #{{id}}",
     "webdavTokenInactive": "Disabled — token #{{id}} is not active",
     "webdavUpdated": "Updated {{at}}",
@@ -4549,6 +4609,22 @@
     "accountCount": "Accounts",
     "loginBanner": "Login banner",
     "sslDomain": "SSL domain",
+    "plaintextInsecure": "Cleartext FTP (no TLS) — insecure. Enable FTPS before exposing port 21.",
+    "plaintextPublicLive": "vsftpd is listening on a public address without FTPS. Credentials travel in the clear. Enable FTPS, bind to this host only, or confirm PLAINTEXT to keep this posture.",
+    "bindAddress": "Listen scope",
+    "bindAddressHint": "New installs bind to this host only. Public listen without FTPS needs a typed confirmation.",
+    "bindLocal": "This host only",
+    "bindLocalHint": "127.0.0.1 — fine without TLS for local tests",
+    "bindPublic": "Public",
+    "bindPublicHint": "All interfaces — enable FTPS or confirm PLAINTEXT",
+    "enableFtpsAndStart": "Enable FTPS and start",
+    "publicPlainNeedConfirm": "Public cleartext FTP needs a PLAINTEXT confirmation",
+    "plainConfirmTitle": "Start public FTP without FTPS?",
+    "plainConfirmDesc": "Port 21 will accept logins and data in the clear on the public address.",
+    "plainConfirmC1": "Usernames and passwords are visible on the network.",
+    "plainConfirmC2": "PASV will advertise the configured public IP.",
+    "plainConfirmC3": "Host firewall and cloud security group are not opened for you.",
+    "plainConfirmAction": "Start cleartext FTP",
     "pasvRange": "PASV range",
     "forceTls": "Force TLS",
     "allowWrite": "Allow write",
@@ -4894,6 +4970,8 @@
     "isolationNote": "Real browser creates an ephemeral Linux user for Chrome; leaving the page or idle timeout destroys that user.",
     "resumeHint": "Resume previous session ({{count}} tabs)",
     "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}",
+    "resumeHintOwned": "Resume last browse for {{user}} ({{count}} tabs) · {{url}} · {{when}}",
+    "clearSessionData": "Clear session data",
     "resume": "Resume",
     "resumeDismiss": "Dismiss",
     "resumeDone": "Session resumed",
@@ -5322,6 +5400,8 @@
     "inventorying": "Inventorying",
     "inventoried": "Inventoried",
     "inventoriedWarn": "Inventoried · {{n}} warnings",
+    "inventoriedOrphans": "Inventoried · {{n}} leftover homes",
+    "inventoriedWarnAndOrphans": "Inventoried · {{w}} warnings · {{n}} leftover",
     "inventoryFailed": "Inventory failed",
     "pendingInventory": "Pending inventory",
     "projects": "Projects",
@@ -5381,7 +5461,18 @@
     "afterRestart": ") then Refresh.",
     "inventoryWarnings": "Inventory warnings ({{count}})",
     "orphanHomesHint": "Leftover project homes (not in the store). Remove only after you confirm they are unused.",
-    "orphanRemove": "Remove leftover home",
+    "orphanHomesTitle": "Leftover project homes ({{count}})",
+    "orphanHomesSummary": "{{count}} path(s) on disk are not in the store. Back up first if unsure, then remove unused paths.",
+    "orphanColHome": "Home",
+    "orphanColModified": "Modified",
+    "orphanColEntries": "Entries",
+    "orphanEntries": "{{n}} top-level entries in the directory",
+    "orphanKpi": "Leftover",
+    "sourceOs": "OS",
+    "sourceDataDir": "dataDir",
+    "sourceDbRedis": "Databases / Redis",
+    "sourceDbRedisValue": "{{db}} databases · {{redis}} Redis",
+    "orphanRemove": "Remove",
     "orphanRemoveTitle": "Delete leftover project home?",
     "orphanRemoveDesc": "Permanently delete {{path}} from disk. This is not a store project. Needs superuser and system-change permission.",
     "orphanRemovePhrase": "Type DELETE to confirm.",
@@ -5518,6 +5609,8 @@
       "up": "Up",
       "down": "Down",
       "unknown": "Unknown",
+      "loopback": "Always on",
+      "loopbackHint": "Loopback is always available and cannot be changed.",
       "other": "Other"
     },
     "statGateway": "Gateway",
@@ -5680,6 +5773,8 @@
     "purgeOk": "Purged",
     "projectSitesHint": "Project sites (managed conf) and standalone sites are listed separately. Edit project Nginx under Projects → Network.",
     "purgeCache": "Purge cache + reload",
+    "purgeCacheTitle": "Purge Nginx cache and reload?",
+    "purgeCacheDesc": "Clears the on-disk cache and reloads Nginx. Live sites stay up.",
     "notInstalled": "Nginx is not installed",
     "listTitle": "Sites ({{count}})",
     "listDesc": "After create, click Apply to sync to the system",
@@ -5755,7 +5850,8 @@
     "setHsts": "HSTS",
     "setCfRealIp": "Cloudflare Real IP",
     "setIndexes": "Directory listing",
-    "bodyInherit": "Global"
+    "bodyInherit": "Global",
+    "stopSites": "{{n}} site(s) will stop answering HTTP."
   },
   "notFound": {
     "title": "Page not found",
@@ -5764,6 +5860,9 @@
     "home": "Dashboard"
   },
   "notes": {
+    "agents": {
+      "sessionNotFound": "Session not found: {{sessionId}}"
+    },
     "notFound": "Not found",
     "needPath": "Specify a path",
     "needName": "Enter a name",
@@ -5830,10 +5929,18 @@
       "targetOutside": "Restore target must be inside the project home or the public files root.",
       "controlPlaneDryRun": "Preview only — nothing written. In the panel, use Restore and confirm the phrase to write.",
       "controlPlaneNeedConfirm": "Full control-plane restore needs the confirm phrase RESTORE-CONTROL-PLANE.",
-      "controlPlaneRestartAfter": "Restart the API after a successful restore."
+      "controlPlaneRestartAfter": "Restart the API after a successful restore.",
+      "movedToTrash": "Moved {{name}} to the recycle bin. Permanent delete after {{days}} days.",
+      "restoreNameExists": "Cannot restore {{name}} — a live archive with that name already exists.",
+      "restoredFromTrash": "Restored {{name}} from the recycle bin.",
+      "trashEmptied": "Permanently deleted {{n}} archive(s) from the recycle bin."
     },
     "redis": {
-      "cliMissing": "redis-cli is not installed"
+      "cliMissing": "redis-cli is not installed",
+      "requirepassAlreadySet": "Redis already has requirepass — not overwritten.",
+      "requirepassApplied": "requirepass applied at runtime",
+      "requirepassApplyFailed": "Could not CONFIG SET requirepass (will rely on restart + conf)",
+      "generatedRequirepass": "Generated Redis password (shown once): {{password}}"
     },
     "nginx": {
       "reloaded": "nginx reloaded",
@@ -5856,7 +5963,8 @@
       "vsftpdStarted": "vsftpd started",
       "openPortsStep": "Firewall ports (manual)",
       "openPortsReminder": "Open TCP ports on host firewall and cloud security group: {{ports}}. FTPS apply does not open ports for you.",
-      "openPortsPasvHint": "If login works but directory LIST times out, the PASV data range is blocked — open the ful"
+      "openPortsPasvHint": "If login works but directory LIST times out, the PASV data range is blocked — open the ful",
+      "publicPlaintextBlocked": "Refusing to start public FTP without FTPS. Bind to this host only, enable FTPS with a certificate, or confirm PLAINTEXT to expose cleartext on the public address."
     },
     "deploy": {
       "nodeMissingIsolated": "Node binary missing for isolated deploy: {{path}} — install Node {{version}} toolchain then redeploy. Refusing to write a unit that would 203/EXEC.",
@@ -5911,7 +6019,17 @@
       "applyDigOk": "PowerDNS BIND: list-zones + dig OK",
       "applyDigFail": "Zone registered in conf but dig still empty/REFUSED — not marking applied",
       "applySyncIncomplete": "PowerDNS bind sync incomplete — zone file on disk only (not applied). Fix EXECUTE/root or pdns logs.",
-      "writeOnlyHint": "Zone file written only — PowerDNS will not answer until load/apply registers named"
+      "writeOnlyHint": "Zone file written only — PowerDNS will not answer until load/apply registers named",
+      "noActiveUnit": "No active named/bind9/pdns unit",
+      "pdnsUnitRestarts": "pdns unit state/restarts: {{detail}}",
+      "port53LoopbackOnly": "Port 53 is only on loopback (systemd-resolved 127.0.0.53) — not a product authoritative nameserver",
+      "port53Closed": "Port 53 is not listening (UDP/TCP)",
+      "udp53NotPublic": "UDP/53 is not listening on a public address",
+      "tcp53NotPublic": "TCP/53 is not listening on a public address",
+      "noManagedZones": "No managed zone files under dataDir/dns/zones",
+      "pdnsListZones": "PowerDNS list-zones: {{n}}",
+      "lookupIgnoredAt": "dig is unavailable — @{{server}} was ignored. Not using the system resolver as that server’s answer.",
+      "localAOk": "local A {{name}} → {{ip}}"
     },
     "db": {
       "needExecuteCreate": "Host execute is off; cannot create database from the panel",
@@ -5960,9 +6078,6 @@
       "postqueueMailDown": "Postfix is not running (showq unavailable). Panel tried to start it when YSK_EXECUTE is on — check the Software tab / systemctl status postfix.",
       "postqueueSpoolMissing": "Postfix queue directories are missing (e.g. hold/). Panel tried to create the spool tree and start Postfix when YSK_EXECUTE is on."
     },
-    "agents": {
-      "sessionNotFound": "Session not found: {{sessionId}}"
-    },
     "software": {
       "startUnit": "Start {{u}}",
       "installedSpec": "Installed {{title}}",
@@ -8301,7 +8416,7 @@
       "t0626": "transfer: home rsync Failed {{v0}}",
       "t0627": "skipped: {{v0}}",
       "t0628": "transfer done → {{v0}}:{{v1}}",
-      "t0629": "project {{v0}} home: {{v1}}",
+      "t0629": "Project {{v0}} has no system user yet (home missing: {{v1}}). Finish isolation on the project page.",
       "t0630": "project {{v0}} bind_ip={{v1}} — can ( IP )",
       "t0631": "project {{v0}} home not path: {{v1}}",
       "t0632": "Orphan home on disk (no matching store project): {{v0}}",
@@ -8718,6 +8833,15 @@
       "needInstall": "Install {{stack}}",
       "needExecute": "YSK_EXECUTE is disabled — cannot install packages or provision Linux users.",
       "needRoot": "Not running as root — system useradd and vncserver apply are blocked.",
+      "hostnameResolves": "Hostname {{hostname}} resolves.",
+      "hostnameUnresolvable": "This host cannot resolve its own hostname ({{hostname}}). VNC session start will fail until /etc/hosts is fixed.",
+      "hostnameAlreadyResolves": "Hostname {{hostname}} already resolves — /etc/hosts unchanged.",
+      "hostnameWouldAppend": "Would append to /etc/hosts: {{line}}",
+      "hostnameAppended": "Appended to /etc/hosts: {{line}}",
+      "hostnameAppendFailed": "Could not write /etc/hosts: {{detail}}",
+      "hostnameAliasPresent": "Hostname {{hostname}} is already an exact /etc/hosts alias — not appended again.",
+      "hostnameStillUnresolvable": "Wrote /etc/hosts but {{hostname}} still does not resolve. Confirm nsswitch hosts includes files.",
+      "skipStartHostname": "Did not start the display — fix hostname resolution first.",
       "novncAssetsOnly": "noVNC web assets found; websockify binary still missing.",
       "viewerNeedExecute": "Starting a local VNC desktop for browser view needs root + YSK_EXECUTE",
       "browserSessionReady": "Browser VNC session ready: {{name}}",
@@ -8904,12 +9028,20 @@
       "dovecotTitle": "Dovecot TLS points at missing cert",
       "dovecot": "Dovecot ssl_cert points at missing {{path}}. Overlay does not rewrite ssl=no. Apply mail TLS after issuing the cert, or apply email stack.",
       "overlayDoesNotHeal": "Product overlay does not rewrite nginx, Apache, vsftpd, or Dovecot. Use the listed apply commands (root + YSK_EXECUTE=1).",
+      "executeStaleCli": "Pass --execute (root + YSK_EXECUTE=1) to remove stale CLI bins.",
+      "executeMissingTls": "Pass --execute (root + YSK_EXECUTE=1) to disable missing-cert TLS so vsftpd/Dovecot can start.",
+      "executeGeneric": "Pass --execute (root + YSK_EXECUTE=1) to apply leftover cleanup for the findings above.",
       "staleCliRemoved": "Removed leftover CLI {{path}}.",
       "staleCliRemoveFailed": "Could not remove leftover CLI {{path}}: {{detail}}",
       "vsftpdSslOff": "Set vsftpd ssl_enable=NO because the FTPS certificate file is missing, then restarted vsftpd.",
       "dovecotSslOff": "Set Dovecot ssl=no because {{path}} is missing, then restarted Dovecot.",
       "readinessTitle": "Host leftovers after overlay",
-      "readinessClean": "No leftover Apache default, missing nginx catch-all, failed vsftpd, or stale CLI detected."
+      "readinessClean": "No leftover Apache default, missing nginx catch-all, failed vsftpd, or stale CLI detected.",
+      "nginxRemoved": "Removed leftover nginx conf {{path}}.",
+      "nginxNotLeftover": "Not a leftover public-files conf — refuse delete.",
+      "nginxUnusedKeep": "000-default is unused, not leftover — not deleted.",
+      "nginxSystemCopy": "System copy still present: {{path}}. Needs YSK_EXECUTE + root to remove.",
+      "nginxReloadFailed": "nginx -t or reload failed after removing {{path}}."
     },
     "defense": {
       "panelReqLabel": "Panel requests / min",
@@ -9108,6 +9240,7 @@
     },
     "next": {
       "pendingOsTitle": "System user not provisioned",
+      "provisionOsAction": "Create system user",
       "pendingOsBody": "This project has no isolated system user yet.",
       "pendingOsActions": "You can still deploy; full isolation needs admin privileges on the host.",
       "deployTitle": "Next: Deploy",
@@ -9979,6 +10112,8 @@
     "unban": "Unban",
     "ban": "Ban",
     "banConfirmTitle": "Ban {{ip}}?",
+    "banConfirmMethod": "Method: {{method}}",
+    "banConfirmUntilUnban": "Stays banned until you unban it (or fail2ban expiry).",
     "banConfirmDesc": "This IP will be blocked on the host. Confirm it is not a current panel or session address.",
     "wlRemovedUndo": "Removed {{ip}} from the allow list. Undo within 5 seconds.",
     "undo": "Undo",
@@ -10180,7 +10315,11 @@
     "publicRootNote": "Public root: {{path}}",
     "applyConfirmTitle": "Apply public-files site?",
     "applyConfirmDesc": "Write Nginx server_name {{name}} and reload Nginx.",
-    "serverNameMismatch": "Live conf uses {{live}}; the form has {{draft}}. Apply to replace."
+    "serverNameMismatch": "Live conf uses {{live}}; the form has {{draft}}. Apply to replace.",
+    "liveName": "Live name",
+    "draftName": "Draft name",
+    "draftUnapplied": "This draft is not applied. Nginx still serves the live name.",
+    "discardDraft": "Discard draft"
   },
   "rbac": {
     "permissions": "Permissions",
@@ -10512,6 +10651,11 @@
     "noRequirepass": "Protected mode is on, but requirepass is empty or unread — no password.",
     "insecureShort": "No password",
     "setRequirepass": "Set password",
+    "generateRequirepass": "Generate and apply password",
+    "generateRequirepassTitle": "Generate a Redis password?",
+    "generateRequirepassDesc": "Writes requirepass and restarts Redis. The password is shown once. Host change needs EXECUTE.",
+    "generateRequirepassDone": "Redis password applied",
+    "generatedOnce": "Generated password (shown once): {{password}}",
     "rdbOnlyLossHint": "AOF is off and RDB is on. A restart or crash can lose recent writes.",
     "dirDataContainer": "/data (container)",
     "dirHostDefault": "/var/lib/redis",
@@ -11183,6 +11327,8 @@
     "reauthPassword": "Re-enter password",
     "reauthPasswordHint": "Start/reset 2FA requires password again (stolen session protection)",
     "reauthPasswordRequired": "Enter your login password first",
+    "needCurrentPassword": "Enter the current password first",
+    "passwordMin8": "New password must be at least 8 characters",
     "totpSecretGenerated": "Secret ready — scan the QR or copy the key, then enter the app’s 6-digit code",
     "reset2fa": "Reset 2FA",
     "start2fa": "Set up 2FA",
@@ -11656,8 +11802,10 @@
     "needRunning": "{{label}} is not running",
     "restartedOk": "{{label}} restarted",
     "reloadedOk": "{{label}} reloaded",
+    "reloadTitle": "Reload {{label}} configuration without a full restart",
     "stopNeedConfirm": "Needs confirmation",
     "stopNeedConfirmPhrase": "Needs confirmation phrase",
+    "stopNeedConfirmImpact": "Stop {{label}}? Active connections to this service will drop.",
     "stopConfirmTitle": "Stop {{label}}?",
     "stopConfirmDesc": "{{label}} will stop listening. Start it again from this page when needed.",
     "stopConfirmEdgeDesc": "Stopping {{label}} takes sites and reverse-proxy traffic offline until it is started again.",
@@ -11668,8 +11816,14 @@
     "stopConfirmSshdConsequence": "New SSH sessions will fail until sshd is started from the host console.",
     "stopConfirmPanelTitle": "Stop YSK Server?",
     "stopConfirmPanelDesc": "The panel and API will go offline until the unit is started on the host.",
+    "stopConfirmPanelSshdOffDesc": "The panel and API will go offline. sshd is not enabled on boot, so SSH may not be a rescue path after reboot.",
+    "stopConfirmPanelSshdOffConsequence": "sshd is not enabled on boot. After reboot you may have no SSH rescue path.",
+    "ufwNoLifecycle": "UFW is not started or stopped from this matrix.",
     "restartConfirmPanelTitle": "Restart YSK Server?",
     "restartConfirmPanelDesc": "The panel and API will drop briefly while the unit restarts.",
+    "restartConfirmTitle": "Restart {{label}}?",
+    "restartConfirmDesc": "Restart {{label}} now. Active connections may drop.",
+    "startVerifyFailed": "{{label}} start did not stay healthy.",
     "stopConfirmPanelToken": "stop ysk-server",
     "stopConfirmPanelConsequence": "This browser session will disconnect. Start the unit from SSH or the host console.",
     "stopConfirmFail2banTitle": "Stop fail2ban?",
@@ -12248,7 +12402,7 @@
     "optional": "Optional",
     "prettyPh": "Friendly display name",
     "timezone": "Timezone",
-    "timezoneHint": "Choose an IANA timezone from the list (e.g. Asia/Hong_Kong)",
+    "timezoneHint": "IANA zone from timedatectl (e.g. Asia/Hong_Kong). This is the host clock — cron and vsftpd local time follow it. Stored timestamps stay UTC.",
     "timezoneNow": "Host time now: {{time}} ({{tz}})",
     "timezoneBrowserDiff": "This host uses {{host}}; your browser uses {{browser}}. Changing timezone here changes the host clock, not the browser.",
     "timezoneSelect": "Select timezone",
@@ -12279,6 +12433,7 @@
       "disable": "Disable panel HTTPS",
       "disableNeedConfirm": "Needs confirmation — type DISABLE-HTTPS",
       "needDomain": "Enter hostname / domain first",
+      "needFqdn": "Need a FQDN (example.com), not a bare hostname",
       "urlHint": "After restart open {{url}}",
       "certMissing": "TLS enabled but cert/key files missing",
       "restartToApply": "Restart ysk-server to apply HTTPS",
@@ -12427,7 +12582,11 @@
     "nginxLeftover": "Leftover",
     "nginxUnused": "Unused",
     "nginxLeftoverHint": "Stale public-files or leftover conf. Still included in sync until you remove or replace it.",
-    "nginxUnusedHint": "Stock / catch-all conf (000-default). Still included in sync until you act."
+    "nginxUnusedHint": "Stock / catch-all conf (000-default). Still included in sync until you act.",
+    "nginxRemoveLeftover": "Remove leftover",
+    "nginxRemoveLeftoverTitle": "Remove leftover nginx conf?",
+    "nginxRemoveLeftoverDesc": "Deletes {{name}} from the panel inventory. The live /etc/nginx copy is removed only with YSK_EXECUTE + root. 000-default is not leftover and cannot be deleted here.",
+    "needExecuteRoot": "Needs YSK_EXECUTE + root"
   },
   "systemd": {
     "enabled": "Enabled",
@@ -12800,6 +12959,7 @@
     "hourAgo": "{{n}}h ago",
     "highRiskN": "{{count}} high-risk",
     "panelUpdate": "Panel update available",
+    "footerNewVersion": "New version {{version}}",
     "riskOk": "Risk manageable",
     "riskUnevaluated": "Not evaluated — run Scan + OSV",
     "pendingScan": "Awaiting scan",
@@ -13171,6 +13331,7 @@
     "tab": {
       "nodes": "Nodes",
       "disk": "Disk",
+      "stack": "Software",
       "about": "About"
     },
     "empty": {
@@ -13178,18 +13339,46 @@
       "desc": "Create a testnet node in a few clicks."
     },
     "refresh": "Refresh",
+    "software": {
+      "engine": "Docker Engine",
+      "engineDesc": "Validator nodes run as Compose projects. Install Docker here if it is missing. Image prune stays on the Docker page.",
+      "client": "Client",
+      "image": "Image",
+      "present": "Local",
+      "local": "Pulled",
+      "missing": "Not pulled",
+      "size": "Size",
+      "usedBy": "Used by",
+      "unused": "No instance",
+      "pull": "Pull",
+      "pulling": "Pull {{ref}}",
+      "empty": "No pinned client images",
+      "emptyDesc": "The catalog is empty. This should not happen.",
+      "daemonDown": "Docker Engine is not running"
+    },
     "disk": {
       "title": "Validator disk",
       "root": "Data directory",
       "free": "Free",
-      "used": "Used",
+      "used": "Validator data",
+      "fsUsed": "Filesystem used",
+      "leftoverTitle": "Leftover data ({{count}})",
+      "leftoverEmpty": "No leftover instance directories",
+      "leftoverDesc": "Directories under the validators root that are not a store instance. Remove only after you confirm they are unused.",
+      "leftoverRemove": "Remove",
+      "leftoverRemoveTitle": "Delete leftover validator data?",
+      "leftoverRemoveDesc": "Permanently delete {{path}} from disk. This is not a listed node.",
+      "browseRoot": "Open in file browser",
       "none": "No instance data yet",
       "warn": "Disk usage is high (70%+)",
       "danger": "Disk usage is critical (85%+)",
       "autoClear": "Auto-clear the largest stopped instance when disk is critical (off by default)",
       "autoClearRisk": "Destructive: the largest stopped instance is deleted without a further prompt. Default is off. Check audit / logs after it fires.",
       "autoClearConfirmTitle": "Enable auto-clear?",
-      "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again."
+      "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again.",
+      "autoClearThreshold": "Trigger: filesystem use at or above 85%.",
+      "autoClearCandidate": "Current candidate: {{id}}",
+      "autoClearNone": "No stopped instance is a candidate right now."
     },
     "chain": {
       "eth": "Ethereum",
@@ -13224,6 +13413,14 @@
       "validator-ready": "Validator-ready",
       "rpc": "RPC"
     },
+    "profileHelp": {
+      "title": "Profiles",
+      "desc": "The four choices on wizard step 3 are mainly disk budget and role. Each chain shows its recommended size in the wizard. The panel never holds staking keys.",
+      "minimal": "Smallest disk. Use for testnets or a first install. Not a full history, and not for a live staking validator.",
+      "pruned": "Keeps recent chain state and drops older blocks (Pruned). More disk than Minimal, less than a full node. Use to follow the tip long-term.",
+      "validatorReady": "Reserves more disk so you can later attest or propose as a validator. Generate keys offline yourself. Being offline or misconfigured can lose stake.",
+      "rpc": "For this host or other services to query the chain. RPC listens on 127.0.0.1 by default and is not published to the internet."
+    },
     "col": {
       "id": "ID",
       "chain": "Chain",
@@ -13233,7 +13430,7 @@
       "disk": "Disk"
     },
     "cli": {
-      "usage": "Usage: ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|policy|mithril|prune|switch-network|snapshot|compose|settings [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--execute] [--json]"
+      "usage": "Usage: ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|policy|mithril|prune|switch-network|snapshot|compose|settings [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--accept-low-disk] [--execute] [--json]"
     },
     "clients": {
       "el": "Execution client",
@@ -13299,7 +13496,8 @@
       "snapshotNear": "Wiped NEAR data; compose will re-init official genesis and epoch sync",
       "nativePrune": "Ran the client-native prune command",
       "dryDelete": "Delete is dry-run. Pass --execute and YSK_EXECUTE=1.",
-      "deleted": "Node deleted"
+      "deleted": "Node deleted",
+      "leftoverRemoved": "Removed leftover {{path}}"
     },
     "create": "Create node",
     "wizard": {
@@ -13311,12 +13509,25 @@
       "stepSummary": "Summary",
       "needDocker": "Docker Engine is not installed. Install it first — this button stays disabled.",
       "diskNeed": "This profile needs about {{need}} · free {{free}}",
+      "diskNeedNetwork": "Default (Minimal) for this network needs about {{need}} · free {{free}}",
+      "profileHint": {
+        "minimal": "Smallest sync — light disk, not for staking.",
+        "pruned": "Keeps recent history only (Pruned). Smaller than archive, still usable for RPC.",
+        "validator-ready": "Sized for a staking validator. Needs more disk than Minimal.",
+        "rpc": "Public RPC node — not a staking validator."
+      },
       "diskShort": "Not enough free disk for this chain / network / profile",
+      "diskShortDetail": "Need {{need}} · free {{free}} · short {{short}}",
+      "needCustomPath": "Enter an absolute data path",
+      "previewId": "Node id",
+      "previewCompose": "Compose project",
+      "profileSeeAbout": "What each profile means is on the About tab.",
       "back": "Back",
       "next": "Next",
       "install": "Install",
       "mainnetWarn": "Mainnet needs a lot of free disk (ETH often 800 GiB+). Testnet is recommended.",
-      "mainnetAck": "I understand the disk and slashing risk. Continue with mainnet.",
+      "mainnetAck": "Create the mainnet node. I understand it needs a lot of disk, and a staking validator can lose stake if it is offline or misconfigured.",
+      "lowDiskAcked": "Free disk is below the recommended size. You confirmed create anyway; sync may stop if the disk fills.",
       "heavyWarn": "This chain is heavy (large disk and high IOPS). Mainnet Solana typically needs 2 TiB+.",
       "memory": "Memory limit",
       "cpus": "CPU limit",
@@ -13328,7 +13539,14 @@
       "installConfirmTitle": "Install this node?",
       "installConfirmDesc": "{{chain}} · {{network}} · {{profile}}. About {{disk}} of disk. The image pull can take a long time.",
       "installC1": "Several gigabytes of images may be downloaded.",
-      "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically."
+      "installC2": "You can cancel the panel task; already-pulled images are not deleted automatically.",
+      "dockerAbout": "Docker Engine is required to install and start nodes.",
+      "dockerAboutOk": "Docker Engine is installed.",
+      "dockerAboutMissing": "Docker Engine is not installed. Open Docker to install it.",
+      "rewriteCompose": "Rewrite compose",
+      "rewriteComposeTitle": "Rewrite compose.yml from the current adapter?",
+      "rewriteComposeDesc": "Overwrites the generated compose for {{id}} using the shipped flags for this chain.",
+      "chainMeta": "{{disk}} min · {{clients}} clients"
     },
     "actions": {
       "detail": "Details",
@@ -13425,6 +13643,7 @@
     "state": {
       "unknown": "Unknown",
       "stopped": "Stopped",
+      "starting": "Starting",
       "running": "Running",
       "syncing": "Syncing",
       "error": "Error"
@@ -13605,6 +13824,13 @@
     "start": "Start",
     "stop": "Stop",
     "startAfterCreate": "Start after create",
+    "hostnameBroken": "This host cannot resolve its own hostname ({{hostname}}). Session start will fail.",
+    "hostnameBrokenIdle": "No VNC sessions yet. Hostname {{hostname}} does not resolve — you can write /etc/hosts later if you create a session.",
+    "hostnameFix": "Write hostname to /etc/hosts",
+    "hostnameFixTitle": "Append this line to /etc/hosts?",
+    "hostnameFixDesc": "{{line}}",
+    "hostnameFixDone": "Hostname /etc/hosts updated",
+    "startAfterCreateBlocked": "Disabled until the hostname resolves",
     "colName": "Name",
     "colLinuxUser": "Linux user",
     "colDisplay": "Display / port",