ysk-server-shared 1.1.12 → 1.1.13

package/locales/en/translation.json

@@ -19,9 +19,17 @@
       "unknown": "Not probed",
       "fallback": "Unknown"
     },
+    "cmdStatus": {
+      "queued": "Queued",
+      "acked": "Acked",
+      "done": "Done",
+      "error": "Error"
+    },
     "activatingStuckHint": "Activating longer than 5 minutes — treated as failed. Check journal.",
     "noOnlineAgents": "No agents online",
     "journal": "journal",
+    "writeUnit": "Write unit",
+    "writeUnitConfirm": "Write the systemd unit for {{kind}} under /etc/systemd. The service is not started or enabled.",
     "liveN": "{{count}} online",
     "registeredOnly": "Registered only",
     "awaitProbe": "Awaiting probe",
@@ -48,10 +56,10 @@
     "capStatus": "Status",
     "capStatusD": "Registered only → online (heartbeat) → stale (>60s without heartbeat) → offline (disconnected / no further heartbeat)",
     "statusFlowTitle": "Status flow",
-    "statusFlow": "Registered only → online → stale (>60s) → offline (disconnected). Filter “Offline” is disconnected.",
+    "statusFlow": "Registered only → online → stale (>60s) → offline. Filter “Offline” means disconnected.",
     "colSession": "Session UUID",
     "copySession": "Copy session UUID for cluster / CLI --session",
-    "staleFor": "Unseen {{age}}",
+    "staleFor": "Stale {{age}}",
     "commandTitle": "Queue a command for this session",
     "historyTitleShort": "Open command history (read-only)",
     "fleetTitle": "Fleet ({{count}})",
@@ -72,6 +80,7 @@
     "finishedAt": "Finished {{at}}",
     "colCommand": "Command",
     "colResult": "Result summary",
+    "colExit": "Exit",
     "hasResult": "Has result",
     "emptyCmds": "No commands yet",
     "emptyCmdsDesc": "Queue with “Command”; stays queued until the edge agent is online",
@@ -87,6 +96,7 @@
     "pathExists": "Exists",
     "pathMissing": "Not installed",
     "unitUnknown": "{{unit}} · unknown",
+    "unitFallback": "unit",
     "path": "Path",
     "probe": "Probe",
     "install": "Install",
@@ -478,7 +488,11 @@
     "skippedListHint": "These projects were skipped:",
     "skippedPendingOs": "Skipped — OS user / home not provisioned",
     "goLogs": "Open logs",
-    "goAbout": "Backup notes"
+    "goAbout": "Backup notes",
+    "previewListingTitle": "Archive contents",
+    "restoreNamedDesc": "Restore {{name}} into project {{project}}.",
+    "overwriteNamedDesc": "Overwrite files of project {{project}} from snapshot {{snapshot}}.",
+    "resticSafeNamed": "Restore snapshot {{snapshot}} of project {{project}} into a safe directory."
   },
   "btTracker": {
     "title": "BT Tracker",
@@ -609,6 +623,12 @@
     "startedOk": "Started",
     "stoppedOk": "Stopped",
     "restoredOk": "Re-seed done",
+    "restoredCount": "Re-seeded {{seeded}} of {{attempted}} torrents",
+    "portInvalid": "Enter a port from 1 to 65535.",
+    "extraTrackerRequired": "Enter an announce URL.",
+    "stopPort": "Tracker port {{port}} will stop listening.",
+    "stopPid": "Process PID {{pid}} will exit.",
+    "swarmLeftoverUnlisted": "{{count}} extra leftover announce(s) have no hash in this list.",
     "httpPortHint": "",
     "udpPortHint": "",
     "udpPortOff": "Off",
@@ -619,7 +639,7 @@
     "tabTrackers": "Trackers",
     "addTorrent": "Add torrent",
     "addTorrentTitle": "Add torrent",
-    "addTorrentHint": "Upload a .torrent or paste a magnet. Choose a Files folder. WebTorrent downloads missing files and seeds when complete.",
+    "addTorrentHint": "Upload a .torrent or paste a magnet. After the file is read, pick where to save. WebTorrent downloads missing files and seeds when complete.",
     "dropTorrent": "Drop a .torrent here",
     "chooseFile": "or choose a file",
     "magnetLabel": "Magnet",
@@ -635,7 +655,7 @@
     "filterPaused": "Paused",
     "filterError": "Error",
     "emptyDrop": "Drop a .torrent here, or choose a file",
-    "emptyHint": "Files go in the folder you pick. If they are already complete, this host seeds. Engine: WebTorrent — no extra download software.",
+    "emptyHint": "Drop a .torrent or paste a magnet. After it is read, the dialog asks where to save. Complete files seed on this host. Engine: WebTorrent.",
     "pause": "Pause",
     "resume": "Resume",
     "openFolder": "Open folder",
@@ -758,6 +778,14 @@
       "partial": "Partial"
     },
     "statSites": "Sites",
+    "statSitesCount": "{{n}} sites",
+    "cacheMethod": {
+      "none": "No estimate",
+      "access_log": "Access log",
+      "cache_dir": "Cache directory",
+      "log_format": "Need log format"
+    },
+    "geoMapLabel": "Geo map (JSON)",
     "statApplyFailed": "Apply failed",
     "pillNodesSites": "{{n}} nodes · {{s}} sites",
     "statOnline": "Online",
@@ -2144,6 +2172,7 @@
     "noData": "No data",
     "input": "Input",
     "pleaseEnter": "Enter {{value}}",
+    "pleaseFill": "Please fill in this field",
     "required": "Required",
     "about": "About",
     "more": "More",
@@ -2497,6 +2526,7 @@
     "wizardDesc": "Create a project and optionally draft DNS / mail / database (apply on each feature page)",
     "projectName": "Project name",
     "projectNameHint": "Display name; creates a matching directory",
+    "nameRequired": "Enter a project name",
     "domainOptional": "Domain (optional)",
     "domainHint": "Required to enable DNS and mail options",
     "runtime": "Runtime",
@@ -2799,12 +2829,12 @@
       "applyBootstrapDesc": "Installs Galera drop-in and bootstrap (galera_new_cluster)",
       "applyJoinDesc": "Installs Galera drop-in and systemctl restart mariadb",
       "confirmApply": "Confirm apply",
-      "deleteClusterTitle": "Delete cluster registration?",
+      "deleteClusterTitle": "Delete cluster registration {{name}} ({{engine}})?",
       "remoteInstallTitle": "Remote-install peer?",
       "pushTitle": "Push to peer?",
       "fleetSyncTitle": "Fleet sync?",
       "confirmOp": "Confirm",
-      "deleteClusterDesc": "System conf is not auto-cleared (v1).",
+      "deleteClusterDesc": "Delete the {{engine}} cluster registration “{{name}}”. System conf is not auto-cleared (v1).",
       "remoteInstallDesc": "Install conf + restart on peer. Needs YSK_EXECUTE + SSH.",
       "pushDesc": "scp files to peer /tmp?",
       "fleetSyncDesc": "Sync cluster snapshot to fleet edge, then apply.",
@@ -2899,7 +2929,14 @@
     "serviceDownBody": "Service is unhealthy",
     "adoptHostDb": "Register in panel (no create): {{name}}",
     "adoptHostDbTitle": "Registers the name in the control plane only — does not change host data",
-    "cleanupExpiredTempUsersTitle": "Drops panel-issued temporary users that have expired"
+    "cleanupExpiredTempUsersTitle": "Drops panel-issued temporary users that have expired",
+    "invalidSqlIdent": "Use a lowercase identifier: start with a letter, then letters, digits, or underscore.",
+    "remoteHostRequired": "Enter a remote host.",
+    "remoteTestUnsaved": "Save this host first, then Test connection. Or fill host and save.",
+    "serverNotInstalled": "This engine is not installed on the server.",
+    "dumpNeedEngine": "Install the engine before exporting a database.",
+    "unboundDatabase": "Database registration removed",
+    "userGoneRefresh": "That user is gone. The list was refreshed."
   },
   "dialogs": {
     "confirmDefault": "Confirm",
@@ -3012,6 +3049,8 @@
     "lookupType": "Query type",
     "lookupResults": "Results ({{count}})",
     "lookupNoAnswerFail": "No answers / failed",
+    "digNotInstalled": "dig is not installed",
+    "digNotInstalledHint": "This tab needs the dig binary (bind9-dnsutils). That is not NXDOMAIN. Install bind9-dnsutils from the host package manager; this page does not auto-install it.",
     "method": "Method: {{method}}",
     "noAnswers": "No answers",
     "noAnswersDesc": "NXDOMAIN, empty RRset, or resolve failure",
@@ -3296,7 +3335,11 @@
       "mutateFailed": "Docker command failed",
       "engineFailed": "Could not control docker.service",
       "badExec": "Exec is limited to allowlisted binaries and presets (no shell, no TTY)",
-      "uninstallBusy": "Stop YSK-managed containers (including validator stacks) before uninstalling Docker"
+      "uninstallBusy": "Stop YSK-managed containers (including validator stacks) before uninstalling Docker",
+      "badCommand": "Invalid command or entrypoint",
+      "portBusy": "Host port {{bind}}:{{port}} is already in use",
+      "nameInUse": "A container named {{name}} already exists. Remove it or pick another name.",
+      "unpublished": "Container did not attach to a network or publish ports. Not treating this as started."
     },
     "notes": {
       "dryMutate": "Dry-run only. Pass --execute and YSK_EXECUTE=1 to change the host.",
@@ -3309,6 +3352,7 @@
       "restart": "Container restarted",
       "remove": "Container removed",
       "ran": "Container started from image",
+      "leftoverRemoved": "Removed leftover container {{name}} after bind failure",
       "pulled": "Image pulled",
       "exec": "Ran allowlisted exec",
       "imageRemoved": "Image removed",
@@ -3378,6 +3422,17 @@
       "scopeBuilder": "Build cache",
       "scopeSystem": "Everything unused",
       "noVolumesYet": "No volumes yet — create one on the Volumes tab first.",
+      "command": "Command",
+      "commandHint": "Optional. Tokens after the image. Leave blank to use the image CMD.",
+      "entrypoint": "Entrypoint",
+      "entrypointHint": "Optional single binary. Leave blank to use the image ENTRYPOINT.",
+      "portMap": "host:container",
+      "portOccupied": "This host port is already in use",
+      "validatorImage": "Managed by validator nodes",
+      "newVolume": "New named volume",
+      "loopbackUrl": "Local test URL",
+      "nginxProxy": "Create Nginx reverse proxy",
+      "intentPorts": "Requested (not published)",
       "customPort": "Another host port",
       "customPortHost": "Host port",
       "customPortContainer": "Container port",
@@ -3557,7 +3612,7 @@
     "subject": "Subject",
     "body": "Body",
     "saveApplyAutoreply": "Save and apply autoreply",
-    "saveAutoreplyWritten": "Save autoreply (written)",
+    "saveAutoreplyWritten": "Save autoreply",
     "suspendApply": "Suspend and apply REJECT",
     "suspendWritten": "Suspend domain (written)",
     "resumeApply": "Resume and update map",
@@ -3653,7 +3708,7 @@
     "createMailboxBtn": "Create mailbox",
     "localPartLabel": "Local part",
     "localPartFullHint": "Full address will be {{local}}@{{domain}}",
-    "passwordOptionalHint8": "Optional; hash written only if at least 8 chars",
+    "passwordOptionalHint8": "Optional; if set, must be at least 8 characters",
     "live": {
       "noMx": "no MX",
       "mxLookupFailed": "MX lookup failed",
@@ -3909,7 +3964,28 @@
     "dovecotFailedStatus": "Dovecot is {{status}}. Open the Software tab for the unit summary.",
     "mailCertMissing": "No certificate for {{hosts}}. Issue it on the SSL page.",
     "mailCertPresent": "A mail certificate is already issued — this is not a missing-cert problem.",
-    "webmailNeedCert": "No certificate for {{host}} — issue it on SSL before forcing HTTPS."
+    "webmailNeedCert": "No certificate for {{host}} — issue it on SSL before forcing HTTPS.",
+    "domainRequired": "Enter a domain",
+    "domainInvalid": "Enter a valid domain",
+    "serverIpRequired": "Enter a server IP",
+    "serverIpInvalid": "Enter a valid IP address",
+    "serverIpv6Invalid": "Enter a valid IPv6 address",
+    "localPartRequired": "Enter a local part",
+    "localPartInvalid": "Local part may only use letters, digits, . _ + -",
+    "aliasDestRequired": "Enter at least one destination address",
+    "mailboxStatusManaged": "Managed",
+    "mailboxStatusActiveShort": "Active",
+    "mailboxStatusDisabledShort": "Disabled",
+    "mailboxStatusSystem": "System provisioned",
+    "mailboxStatusPending": "Pending system",
+    "mailboxStatusFailed": "System failed",
+    "dnsblCleanStatus": "Not listed",
+    "dnsblListedStatus": "Listed",
+    "deliverabilityDone": "Delivery check complete ({{score}}/100)",
+    "sieveEmpty": "No written Sieve files",
+    "sieveListed": "{{count}} written file(s)",
+    "webmailHostnameRequired": "Enter a webmail hostname",
+    "sieveFilesTitle": "Written files"
   },
   "errors": {
     "YSK_UNAUTHORIZED": "Unauthorized",
@@ -4232,6 +4308,7 @@
     "noVersions": "No version history yet",
     "noVersionsHint": "",
     "versionRestored": "Restored",
+    "restoreVersionConfirm": "Restore {{version}} over the current file {{file}}? This overwrites the file on disk.",
     "renameTitle": "Rename",
     "renameCurrent": "Current: {{name}}",
     "renamed": "Renamed",
@@ -4570,6 +4647,7 @@
     "keyFingerprint": "Key fingerprint (prefix)",
     "createHint": "Create an FTP account on the Accounts tab first, then return here to register keys.",
     "pubkeyHint": "Use “+ Add public key”, choose an FTP user, and paste a full ssh-ed25519 or ssh-rsa line.",
+    "sftpKeyInvalid": "Need a username and a public key that starts with ssh-.",
     "quickSelect": "Quick-select account",
     "quickSelectHint": "Click a username to fill the new-key form",
     "editAccount": "Edit FTP account",
@@ -4595,6 +4673,7 @@
     "sshPubkey": "SSH public key",
     "sshPubkeyHint": "Usually from ~/.ssh/id_ed25519.pub, paste whole line",
     "deleteAccountTitle": "Delete FTP account?",
+    "deleteAccountNamed": "Delete FTP account {{name}}?",
     "deleteAccountDesc": "Apply again after remove",
     "deleteKeyTitle": "Delete SFTP public key?",
     "deleteKeyDesc": "Removes from management file; system authorized_keys may need reload.",
@@ -4972,6 +5051,7 @@
     "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}",
     "resumeHintOwned": "Resume last browse for {{user}} ({{count}} tabs) · {{url}} · {{when}}",
     "clearSessionData": "Clear session data",
+    "clearSessionConfirm": "This discards the resume snapshot for the previous browse session. You cannot restore those tabs afterwards.",
     "resume": "Resume",
     "resumeDismiss": "Dismiss",
     "resumeDone": "Session resumed",
@@ -5360,6 +5440,7 @@
     "applyRenice": "Apply renice",
     "reniceHint": "-20 highest · 19 lowest (needs EXECUTE)",
     "noData": "No data",
+    "shareOfMeasured": "{{pct}}% of measured",
     "mountsTitle": "Disk mounts ({{count}})",
     "mountsDesc": "Real disk usage (temporary filesystems filtered)",
     "noMounts": "No mount list",
@@ -5446,6 +5527,14 @@
     "jobsTitle": "Migration jobs ({{count}})",
     "jobsDesc": "State under dataDir/migrate/;",
     "phase": "Phase",
+    "jobPhase": "Job {{id}} · {{phase}}",
+    "phaseName": {
+      "failed": "Failed",
+      "done": "Done",
+      "running": "Running",
+      "queued": "Queued",
+      "cancelled": "Cancelled"
+    },
     "target": "Target",
     "updated": "Updated",
     "notes": "Notes",
@@ -5538,6 +5627,7 @@
     "postgresService": "PostgreSQL service",
     "redis": "Redis",
     "redisService": "Redis service",
+    "cluster": "Clusters",
     "dns": "DNS",
     "ssl": "SSL certificates",
     "nginx": "Nginx",
@@ -5690,6 +5780,10 @@
     "saveIpHint": "Write connection +ipv4/ipv6.addresses and connection up",
     "confirmIfaceName": "Type interface name “{{name}}” to confirm",
     "deleteRouteTitle": "Delete route?",
+    "deleteRouteNamed": "Delete route {{dst}}?",
+    "deleteRouteBody": "Remove {{dst}}{{via}}{{dev}} from the live routing table.",
+    "viaGw": " via {{gw}}",
+    "onDev": " on {{dev}}",
     "deleteDefaultWarn": "— deleting default may drop connectivity.",
     "alsoRemoveNm": "Also remove from NetworkManager connection (gone after reboot)",
     "loadFailed": "Load failed",
@@ -5796,6 +5890,11 @@
     "editDesc": "Apply required after save",
     "deleteTitle": "Delete site?",
     "deleteDesc": "Delete this site?",
+    "deleteTitleNamed": "Delete site {{name}}?",
+    "deleteDescNamed": "Remove {{name}} from the panel. Applied sites will also drop their managed nginx conf.",
+    "invalidServerName": "Enter a valid hostname (e.g. app.example.com).",
+    "needUpstream": "Upstream is required for reverse proxy sites.",
+    "needRoot": "Document root is required for static and PHP sites.",
     "serverNameHint": "server_name, e.g. app.example.com",
     "kindLabel": "Site type",
     "upstreamLabel": "Upstream",
@@ -5838,7 +5937,7 @@
     "settingsSaved": "Saved",
     "setGzip": "Gzip",
     "setShowVersion": "Show server version",
-    "setShowVersionDesc": "Off = server_tokens off",
+    "setShowVersionDesc": "Checked = server_tokens on (nginx version in response headers)",
     "setHttp2": "HTTP/2 (SSL)",
     "setBody": "Max body",
     "setKeepalive": "Keepalive",
@@ -5866,6 +5965,7 @@
     "notFound": "Not found",
     "needPath": "Specify a path",
     "needName": "Enter a name",
+    "needHost": "Enter a host",
     "needDomain": "Enter a domain",
     "needProjectName": "Enter a project name",
     "needServerIp": "Specify a server IP",
@@ -5933,7 +6033,14 @@
       "movedToTrash": "Moved {{name}} to the recycle bin. Permanent delete after {{days}} days.",
       "restoreNameExists": "Cannot restore {{name}} — a live archive with that name already exists.",
       "restoredFromTrash": "Restored {{name}} from the recycle bin.",
-      "trashEmptied": "Permanently deleted {{n}} archive(s) from the recycle bin."
+      "trashEmptied": "Permanently deleted {{n}} archive(s) from the recycle bin.",
+      "partialOk": "Partial success — {{n}} project(s) skipped"
+    },
+    "health": {
+      "portListening": "Port {{port}} is listening",
+      "portNotListening": "Port {{port}} is not listening",
+      "httpOk": "HTTP OK {{status}}",
+      "httpFail": "HTTP failed: {{detail}}"
     },
     "redis": {
       "cliMissing": "redis-cli is not installed",
@@ -5949,6 +6056,7 @@
       "managedDir": "Managed config dir: {{path}}",
       "includeHint": "In nginx: include {{path}}/*.conf;",
       "removedOrphan": "Removed orphan nginx conf {{path}}",
+      "keptLiveSsl": "Kept live HTTPS block in {{path}} (managed template had no listen 443)",
       "orphanCleanupFailed": "Orphan nginx cleanup failed: {{detail}}",
       "settingsWritten": "Nginx global snippet written",
       "settingsNeedExecute": "Apply needs YSK_EXECUTE",
@@ -6029,6 +6137,8 @@
       "noManagedZones": "No managed zone files under dataDir/dns/zones",
       "pdnsListZones": "PowerDNS list-zones: {{n}}",
       "lookupIgnoredAt": "dig is unavailable — @{{server}} was ignored. Not using the system resolver as that server’s answer.",
+      "digNotInstalled": "dig is not installed",
+      "digEmpty": "dig: no answer",
       "localAOk": "local A {{name}} → {{ip}}"
     },
     "db": {
@@ -6076,7 +6186,11 @@
       "dovecotPassdbWrittenNeedApply": "Passwd-file written under dataDir — run apply (EXECUTE+root) so Dovecot loads it",
       "postqueueSetgidBroken": "Postfix queue tools failed: setgid_group is empty in main.cf. Set setgid_group=postdrop (panel tries to fix when YSK_EXECUTE is on).",
       "postqueueMailDown": "Postfix is not running (showq unavailable). Panel tried to start it when YSK_EXECUTE is on — check the Software tab / systemctl status postfix.",
-      "postqueueSpoolMissing": "Postfix queue directories are missing (e.g. hold/). Panel tried to create the spool tree and start Postfix when YSK_EXECUTE is on."
+      "postqueueSpoolMissing": "Postfix queue directories are missing (e.g. hold/). Panel tried to create the spool tree and start Postfix when YSK_EXECUTE is on.",
+      "invalidDomain": "Enter a valid mail domain",
+      "invalidServerIp": "Enter a valid server IP",
+      "mailboxLocalPartInvalid": "Mailbox local-part may only use letters, digits, . _ + -",
+      "passwordTooShort": "Password must be at least 8 characters"
     },
     "software": {
       "startUnit": "Start {{u}}",
@@ -8117,7 +8231,7 @@
       "t0327": " (skipped {{v0}} without a home dir)",
       "t0328": "projectdirectory: {{v0}}",
       "t0329": "tar failed: {{v0}}",
-      "t0330": "Wrotebackup {{v0}}",
+      "t0330": "Wrote backup {{v0}}",
       "t0331": "Preview: {{v0}} files in the archive (showing {{v1}})",
       "t0332": "cannot: {{v0}}",
       "t0333": "restore (web) to {{v0}}",
@@ -8796,10 +8910,10 @@
       "serverMissing": "WireGuard server not initialized — run Start server first.",
       "peerCreated": "Client «{{name}}» created.",
       "peerNotFound": "Client not found.",
-      "peerRemoved": "Client removed.",
+      "peerRemoved": "Removed {{name}}.",
       "peersSynced": "Peer list reloaded on the running WireGuard interface.",
       "setEndpointHint": "Set public endpoint (host:port) so mobile clients can reach this server.",
-      "invalidConf": "Conf must include [Interface] and PrivateKey.",
+      "invalidConf": "This file is not a valid VPN client conf. Use a WireGuard or OpenVPN client profile.",
       "clientImported": "Profile «{{name}}» imported.",
       "profileNotFound": "Client profile not found.",
       "clientUpFailed": "Connect failed: {{detail}}",
@@ -9112,7 +9226,11 @@
     "stepStoppedOld": "Stopped previous process",
     "stepTuningApplied": "Runtime tuning applied",
     "stepUnitWritten": "Service unit written",
-    "stepSystemdStartFailed": "Systemd start failed — using process fallback"
+    "stepSystemdStartFailed": "Systemd start failed — using process fallback",
+    "portListening": "Port {{port}} is listening",
+    "portNotListening": "Port {{port}} is not listening",
+    "httpOk": "HTTP OK {{status}}",
+    "httpFail": "HTTP failed: {{detail}}"
   },
   "pageGuide": {
     "missing": "No help content is available for this page yet.",
@@ -9858,7 +9976,10 @@
     "gitBehindShort": "↓{{count}}",
     "gitAheadShort": "↑{{count}}",
     "gitDirtyShort": "Dirty · {{count}}",
-    "gitFilesLink": "Files"
+    "gitFilesLink": "Files",
+    "nameInvalid": "Use a lowercase name: start with a letter, then letters, digits, or hyphen (max 31).",
+    "deployVersionMissing": "Node {{version}} is not installed on this host. Pick an installed version, or install this version first.",
+    "deployUsedBinary": "Deploy used {{path}}"
   },
   "protection": {
     "levels": {
@@ -10100,8 +10221,8 @@
     "block": "Block",
     "allow": "Allow",
     "matched": "Matched",
-    "applyStricterTitle": "Apply stricter preset?",
-    "applyStricterDesc": "May enable auto-ban. Confirm your IP is whitelisted.",
+    "applyStricterTitle": "Apply {{name}}?",
+    "applyStricterDesc": "May enable auto-ban. Confirm your IP is whitelisted. Review the profile changes below.",
     "confirmEmergencyTitle": "Confirm emergency preset",
     "confirmEmergencyDesc": "Emergency extremely rate-limits. Confirm whitelist and type EMERGENCY.",
     "confirmString": "Confirm string",
@@ -10291,8 +10412,11 @@
       "notSynced": "Managed conf exists but is not under /etc/nginx/conf.d — apply again as root with YSK_EXECUTE"
     },
     "quotaMiB": "Quota (MiB)",
-    "quotaHint": "Optional; caps public directory size",
+    "quotaHint": "Optional; caps public directory size. Unlimited disables the MiB field.",
     "unlimited": "Unlimited",
+    "quotaInvalid": "Enter a whole number of MiB, or choose Unlimited.",
+    "serverNameRequired": "Enter a server name.",
+    "serverNameInvalid": "Use a hostname, wildcard, or IP — no spaces or punctuation.",
     "applyHint": "Apply only writes config;",
     "appliedOk": "Public files site applied",
     "applyReload": "Apply and reload Nginx",
@@ -10431,8 +10555,8 @@
     "unsavedHint": "Unsaved edits on this role",
     "nothingToSave": "Nothing to save",
     "saveRole": "Save {{role}} policy",
-    "discardTitle": "Discard unsaved policy?",
-    "discardDesc": "Switching roles drops unsaved capability edits."
+    "discardTitle": "Discard unsaved changes?",
+    "discardDesc": "Unsaved permission edits will be discarded."
   },
   "readiness": {
     "cat": {
@@ -10757,6 +10881,10 @@
     "globalPhpIniDesc": "One setting per row",
     "managePath": "Management path",
     "loading": "Loading",
+    "probing": "Probing…",
+    "noBinaryPath": "No binary path",
+    "hostDefaultError": "Host default unavailable",
+    "pm2Tick": "{{at}} · projects {{projects}} · PM2 {{pm2}} · running {{run}}",
     "cannotLoadSettings": "Cannot load settings table",
     "reloadFailed": "Reload failed",
     "sensitive": "Sensitive setting — careful",
@@ -10774,6 +10902,7 @@
     "demoVhost": "System tools: demo vhost / pool",
     "demoVhostDesc": "Advanced/debug; daily sites use Projects → Deploy",
     "domain": "Domain",
+    "domainRequired": "Enter a valid domain before applying the vhost.",
     "vhostServerName": "Virtual host server_name",
     "poolName": "Pool name",
     "poolNameHint": "Hand-typed id (demo); project paths use ysks_* users",
@@ -11132,7 +11261,8 @@
         "interpreter": "Interpreter",
         "user": "User",
         "unit": "Unit",
-        "runtime": "Runtime"
+        "runtime": "Runtime",
+        "pid": "PID"
       },
       "projectsTitle": "YSK project processes",
       "projectsDesc": "systemd units for panel projects (default deploy path — not PM2).",
@@ -11823,6 +11953,11 @@
     "restartConfirmPanelDesc": "The panel and API will drop briefly while the unit restarts.",
     "restartConfirmTitle": "Restart {{label}}?",
     "restartConfirmDesc": "Restart {{label}} now. Active connections may drop.",
+    "restartConfirmConsequence": "{{label}} will briefly interrupt connections, then keep serving HTTP/HTTPS.",
+    "reloadConfirmTitle": "Reload {{label}}?",
+    "reloadConfirmDesc": "Reload {{label}} configuration. Existing sessions should stay up.",
+    "enableConfirmTitle": "Enable {{label}} at boot?",
+    "enableConfirmDesc": "Enable {{label}} so it starts on boot.",
     "startVerifyFailed": "{{label}} start did not stay healthy.",
     "stopConfirmPanelToken": "stop ysk-server",
     "stopConfirmPanelConsequence": "This browser session will disconnect. Start the unit from SSH or the host console.",
@@ -11866,7 +12001,19 @@
     "protectionDoneNote": "Protection probe finished",
     "probeDone": "Probe complete",
     "runProtection": "Run protection probe",
-    "notProbedYet": "Not probed yet"
+    "notProbedYet": "Not probed yet",
+    "cat": {
+      "web": "Web",
+      "db": "Databases",
+      "mail": "Mail",
+      "dns": "DNS",
+      "ftp": "FTP",
+      "cache": "Cache",
+      "panel": "Panel",
+      "ssh": "SSH",
+      "other": "Other",
+      "runtime": "Runtimes"
+    }
   },
   "software": {
     "title": "Software",
@@ -11954,6 +12101,8 @@
       "latest": "Latest",
       "upToDate": "Up to date / repo latest",
       "refresh": "Recheck latest",
+      "refreshHasUpdate": "Newer version available",
+      "refreshLatest": "Already the latest recorded version",
       "pick": "Pick version",
       "noTarget": "No update target",
       "needRuntimePage": "Install this version on the runtime page",
@@ -12327,7 +12476,22 @@
     "uninstallNow": "Uninstall now",
     "uninstallNeedSelect": "Select at least one bundle. Empty selection no longer means remove all.",
     "uninstallConfirmTitle": "Remove selected bundles?",
-    "uninstallConfirmDesc": "{{count}} bundle(s) will be removed. Type REMOVE to confirm."
+    "uninstallConfirmDesc": "{{count}} bundle(s) will be removed. Type REMOVE to confirm.",
+    "bundle": {
+      "control-plane": "Control plane",
+      "web": "Web hosting",
+      "database": "Databases",
+      "email": "Mail stack",
+      "dns": "DNS",
+      "ftp": "FTP / FTPS",
+      "defense": "Host defense",
+      "runtimes": "Language runtimes"
+    },
+    "planTitle": {
+      "minimal": "Control plane only",
+      "recommended": "Recommended hosting",
+      "full": "All software"
+    }
   },
   "support": {
     "title": "Support",
@@ -12689,7 +12853,9 @@
     "scrollRight": "Scroll tabs right",
     "about": "About",
     "main": "Actions",
-    "stack": "Software"
+    "stack": "Software",
+    "unknown": "No such tab",
+    "unknownHint": "This page has no tab named {{tab}}."
   },
   "terminal": {
     "tabSession": "Session",
@@ -13033,6 +13199,8 @@
     "selfCurrentShort": "Current",
     "selfLatestShort": "Latest",
     "applyPanelUpdate": "Apply panel update",
+    "applySelfConfirmTitle": "Apply panel update?",
+    "applySelfConfirmDesc": "Install {{from}} → {{to}} and restart the panel service. There is no dry-run.",
     "applyPanelAlreadyLatest": "Already the latest panel version",
     "recheck": "Recheck",
     "aboutScope": "Scope",
@@ -13045,7 +13213,7 @@
     "jobsSub": "Control-plane scheduler (read-only) · {{count}}",
     "noJobs": "No visible schedules",
     "noJobsDesc": "Disabled or no scheduler jobs yet",
-    "lastRun": " · last {{when}}",
+    "lastRun": "last {{when}}",
     "scanPolicy": "Scan",
     "scanPolicyV": "Scan ≠ upgraded; apply changes the system",
     "highRiskPolicy": "High risk",
@@ -13243,6 +13411,7 @@
     "mailboxes": "Mailboxes",
     "diskMiB": "Disk MiB",
     "noPackages": "No packages yet",
+    "noPackagesHint": "Create a plan from the toolbar, then bind it to users.",
     "createUserDesc": "Password min 8 chars; edit role and permissions in detail later",
     "username": "Username",
     "passwordHint": "At least 8 characters",
@@ -13378,6 +13547,7 @@
       "autoClearC1": "When disk is critical, the largest stopped instance is deleted without asking again.",
       "autoClearThreshold": "Trigger: filesystem use at or above 85%.",
       "autoClearCandidate": "Current candidate: {{id}}",
+      "autoClearCandidates": "Stopped candidates (largest with data first): {{list}}",
       "autoClearNone": "No stopped instance is a candidate right now."
     },
     "chain": {
@@ -13452,7 +13622,8 @@
       "cl": "Consensus client"
     },
     "mithril": {
-      "label": "Restore from Mithril snapshot first (recommended on testnet)",
+      "label": "After the node is up, restore from a Mithril snapshot",
+      "hint": "This is a one-time restore after install. It is not written into compose. You can also run it later from the instance page.",
       "action": "Restore with Mithril"
     },
     "errors": {
@@ -13462,6 +13633,8 @@
       "diskUnknownMainnet": "Cannot measure free disk; refusing mainnet create",
       "needDocker": "Docker Compose is required and was not found",
       "composeFailed": "docker compose failed",
+      "containerNotUp": "Compose started, but the container did not stay running",
+      "probeFailed": "The node is not answering RPC yet. Check logs on this page.",
       "needConfirm": "Clear requires confirm=instance id or CLEAR",
       "mithrilAdaOnly": "Mithril restore is only available for Cardano",
       "needMithrilConfirm": "Mithril requires confirm=instance id or MITHRIL",
@@ -14085,6 +14258,7 @@
     "hostnameFixDesc": "{{line}}",
     "hostnameFixDone": "Hostname /etc/hosts updated",
     "startAfterCreateBlocked": "Disabled until the hostname resolves",
+    "startHostnameBlocked": "Cannot start until this host can resolve its hostname. Use “Write hostname to /etc/hosts”.",
     "colName": "Name",
     "colLinuxUser": "Linux user",
     "colDisplay": "Display / port",
@@ -14243,6 +14417,8 @@
     "peersTitleSs": "Access keys",
     "peerName": "Name",
     "peerNamePlaceholder": "office-laptop",
+    "peerNameHint": "Letters, digits, . _ - — no spaces, / or !",
+    "peerNameInvalid": "Spaces, / and ! are not allowed. Use {{preview}} or change the name.",
     "addPeer": "+ Add",
     "installEngineFirst": "Install the VPN engine first",
     "needServerRunning": "{{engine}} is not running — apply the server first",
@@ -14252,6 +14428,16 @@
     "hidePrivateKey": "Hide private key",
     "deletePeerTitle": "Delete peer {{name}}?",
     "deletePeerDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the config cannot be restored. The WireGuard server stays up.",
+    "deleteClientTitle": "Delete OpenVPN client {{name}}?",
+    "deleteClientDesc": "Remove {{name}} ({{address}}). The client disconnects immediately and the profile cannot be restored. The OpenVPN server stays up.",
+    "deleteKeyTitle": "Delete Shadowsocks key {{name}}?",
+    "deleteKeyDesc": "Remove access key {{name}} ({{address}}). Clients using this key disconnect. The Shadowsocks server stays up.",
+    "deleteResult": "Removed {{name}}.",
+    "portInvalid": "Listen port must be an integer from 1 to 65535.",
+    "portRequired": "Listen port is required.",
+    "importInvalid": "Could not detect a WireGuard or OpenVPN client conf.",
+    "qrFailed": "Could not generate a QR code for this config. Download or copy the text instead.",
+    "cfgTitle": "Config — {{name}}",
     "addPeerWg": "+ Add peer",
     "addPeerOvpn": "+ Add client",
     "addPeerSs": "+ Add key",
@@ -14306,7 +14492,9 @@
       "customHint": "Only the CIDRs you list enter the tunnel. Reconnect after apply.",
       "lanCidrs": "LAN networks",
       "customCidr": "CIDR",
-      "addCidr": "Add"
+      "addCidr": "Add",
+      "cidrRequired": "Enter a CIDR (for example 192.168.1.0/24).",
+      "cidrInvalid": "Enter a valid CIDR, for example 192.168.1.0/24."
     },
     "engineNotInstalled": "This VPN engine is not installed on the host.",
     "serverNotListening": "Server unit is not active. UDP/TCP {{port}} may be closed."