ysk-server-shared 1.1.24 → 1.1.26

package/locales/en/translation.json

@@ -962,7 +962,7 @@
     },
     "help": {
       "blurb": "Control plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json",
-      "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|delete|enable|disable|run|install|status\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
+      "main": "{{product}} ({{cli}}) v{{version}}\n\nControl plane CLI — prefer --json for AI agents.\nDocs: docs/agent/README.md · docs/cli/reference.md · docs/agent/commands.json\n\nUsage:\n  {{cli}} <command> [options]\n\nCommands:\n  setup                 Init dataDir + admin\n  update                Self-update check/apply\n  serve                 HTTP API + Web UI\n  system unit-install   Install ysk-server.service [--enable]\n  stack                 plans|bundles|status|install|uninstall\n  tools                 List tools; tools run --tool <name> [--dry-run]\n  ask                   NL → AI plan [--execute]\n  projects              list|get|create|deploy|stop|health|backup|template\n  users                 list|create|totp\n  packages              list\n  rbac                  list|show\n  audit                 list\n  backup                all|list|status|restore|delete|schedule|control-plane|settings|restic\n  templates             App templates\n  hosting               nginx|dns|db|firewall helpers\n  dns                   zone|zones|lookup|ddns\n  logs                  sources|query|journal|overview\n  host                  overview|metrics (read-only)\n  nginx                 status|list|test|sync\n  ssl                   list|get (certificates)\n  db-cluster            list|get|create|plan (HA plan-first)\n  ssh-key               list|create|import|public|export|install|delete (SSH identity vault)\n  ssh-2fa               list|enroll|confirm|install|pam|retire (SSH login TOTP ≠ panel 2FA)\n  services              Host service matrix (systemctl probe)\n  defense | protection  status|ban|unban|whitelist\n  security              status|sessions|api-keys (2FA flags · session revoke · API keys)\n  cdn                   nodes|sites|render|apply|purge|probe|dashboard|health-loop|from-project\n  agents                runtimes|fleet list|commands|register (panel + edge)\n  agent run             Outbound fleet poller (experimental)\n  store                 status|export|import|migrate (json|sqlite|postgres document backends)\n  files                 list|read|write|mkdir|rm|stat|rename|copy|move|chmod|trash|shares (sandbox)\n  cron                  list|create|update|delete|enable|disable|run|install|status|host\n  email                 domains|mailboxes|deliverability|bootstrap|dns (panel parity)\n  health                Local mode snapshot or --url http://host:port/health\n  notifications         list\n  readiness | doctor    Production readiness (honest)\n  migrate               inventory|host|post|status|resume|orphan-homes (full host migrate)\n  vpn                   WireGuard / OpenVPN\n  vnc                   accounts|clients|share\n  apache                sites|settings\n  network               ifaces|exposure|real-ip\n  real-ip               CDN Real IP\n  updates               inventory|apply\n  software              list|install|uninstall\n  db                    MySQL / MariaDB / PostgreSQL\n  redis                 status|keys|get|set\n  ftp                   accounts|status\n  runtimes              list|install\n  bt-tracker            status|settings\n  validators            list|chains|disk|get|checklist (Beta)\n  docker                status|ps|images|compose|prune (engine)\n  version | help\n\nGlobal:\n  --json                JSON stdout (AI)\n  --data-dir PATH       also --data-dir=PATH or YSK_DATA_DIR\n  --config PATH\n  --locale CODE         CLI language (default en). Also YSK_LOCALE.\n                        Codes: en zh-HK zh-CN ja ko hi es ar fr bn pt id ur\n  --limit N --offset N  Slice large JSON lists (software / updates / host metrics / rbac)\n  --help | --version\n\nExit: 0 ok · 1 error · 2 validation · 3 blocked · 4 not found · 5 host error\n\nSafety:\n  Dangerous ops default to dry-run (plan only).\n  Pass --execute (alias --apply) + env YSK_EXECUTE=1 to mutate host.\n  Command names and flags are always English. --locale only translates messages.\n\nExamples:\n  {{cli}} readiness --json\n  {{cli}} host --json\n  {{cli}} nginx status --json\n  {{cli}} ssl list --json\n  {{cli}} projects get --id UUID --json\n  {{cli}} defense ban --ip 1.2.3.4 --json          # dry-run plan\n  {{cli}} projects list --json\n  {{cli}} --locale=zh-HK help\n  {{cli}} logs query --source journal: --lines 100 --json\n  {{cli}} tools --json"
     },
     "usage": {
       "tools": {
@@ -1065,7 +1065,7 @@
           "--data-dir": {
             "path": {
               "--json": {
-                "0349e6": "Usage: ysk-server cron <sub> [--data-dir PATH] [--json]\n  list [--project-id ID] [--q TEXT]\n  create --schedule \"0 3 * * *\" --command CMD [--project-id ID] [--user USER]\n  delete --id JOB_ID\n  enable|disable --id JOB_ID\n  run --id JOB_ID              # run-now (needs YSK_EXECUTE=1)\n  install                     # load managed crontab (needs EXECUTE)\n  status                      # probe managed file vs host crontab\nHonesty: install blocked without YSK_EXECUTE=1 (file still written).\n"
+                "0349e6": "Usage: ysk-server cron <sub> [--data-dir PATH] [--json]\n  list [--project-id ID] [--q TEXT]\n  create --schedule \"0 3 * * *\" --command CMD [--project-id ID] [--user USER]\n  update --id JOB_ID [--schedule S] [--command CMD] [--user USER] [--project-id ID] [--enable|--disable]\n  delete --id JOB_ID\n  enable|disable --id JOB_ID\n  run --id JOB_ID              # run-now (needs YSK_EXECUTE=1)\n  install                     # load managed crontab (needs EXECUTE)\n  status                      # probe managed file vs host crontab\n  host [list] [--user USER] [--jobs-only]\n  host edit --user USER --old-schedule S --old-command C --schedule S --command C --execute\n  host disable|enable|delete|adopt --user USER --old-schedule S --old-command C --execute\n  host run --user USER --command C --execute\nHonesty: install / host write blocked without YSK_EXECUTE=1.\n"
               }
             }
           }
@@ -2436,7 +2436,35 @@
     "writtenOnHostHint": "Lines already written to the host crontab",
     "registeredJobsHint": "Jobs registered in the panel (including pending install)",
     "pendingInstallCount": "{{n}} pending install",
-    "systemJobBadge": "No project · system user"
+    "systemJobBadge": "No project · system user",
+    "hostEdit": "Edit",
+    "hostEditTitle": "Edit host crontab line",
+    "hostEditDesc": "Writes this user’s live crontab now. Needs root and YSK_EXECUTE=1. Other lines stay.",
+    "hostSave": "Write crontab",
+    "hostSaveTitle": "Write this crontab line?",
+    "hostSaveDesc": "Replaces the live line for {{user}}. Type EDIT to confirm.",
+    "hostDisable": "Disable",
+    "hostDisableTitle": "Disable host crontab line?",
+    "hostDisableDesc": "Comments the line for {{user}}. Type DISABLE to confirm.",
+    "hostEnable": "Enable",
+    "hostEnableTitle": "Enable host crontab line?",
+    "hostEnableDesc": "Removes the comment for {{user}}. Type ENABLE to confirm.",
+    "hostRunTitle": "Run this host command once?",
+    "hostRunDesc": "Runs as {{user}} now. Does not change crontab. Type RUN to confirm.",
+    "hostAdopt": "Take into panel",
+    "hostAdoptTitle": "Take this host line into the panel?",
+    "hostAdoptDesc": "Tags the live line # ysk:id and registers it. Next install will not duplicate it. Type ADOPT to confirm.",
+    "hostDeleteTitle": "Remove host crontab line?",
+    "hostDeleteDesc": "Removes the live line for {{user}}. Type the command to confirm.",
+    "hostUserLocked": "Crontab owner (cannot move between users here)",
+    "hostLinePreview": "Line that will be written",
+    "disabledJob": "Disabled",
+    "confirmMismatch": "Confirm must match the command.",
+    "writtenHost": "Wrote host crontab",
+    "adoptedHost": "Taken into the panel",
+    "keepDisabledHint": "This line is disabled. Save keeps it commented.",
+    "currentLine": "Current",
+    "nextLine": "Next"
   },
   "dashboard": {
     "serviceAria": "{{name}}: {{state}}",
@@ -8933,7 +8961,27 @@
       "noHostLinesOrEmpty": "No extra non-YSK host crontab lines (or empty).",
       "installReplacesYskOnly": "Install updates YSK-marked jobs only; other host jobs were merged and kept.",
       "hostScanNeedRoot": "Reading other users’ crontabs requires the control plane as root; only the process user’s crontab is listed.",
-      "hostScanSkipUser": "Skipped user {{user}} (no permission)"
+      "hostScanSkipUser": "Skipped user {{user}} (no permission)",
+      "hostUserInvalid": "Invalid crontab user.",
+      "hostScheduleInvalid": "Invalid host cron schedule.",
+      "hostLineNotJob": "That crontab line is not a job.",
+      "hostLineMissing": "No matching crontab line (host crontab may have changed).",
+      "hostLineDuplicate": "That job line appears {{count}} times; edit one unique line first.",
+      "hostReadFailed": "Could not read crontab: {{detail}}",
+      "hostWriteFailed": "crontab write failed: {{detail}}",
+      "hostRewriteNeedExecute": "Writing a host crontab line needs root and YSK_EXECUTE=1. Preview only.",
+      "hostRewriteNeedRoot": "Editing another user’s crontab needs the control plane as root.",
+      "hostPreview": "Next line: {{line}}",
+      "hostPreviewDelete": "Next: remove that line.",
+      "hostRewritten": "Wrote crontab for {{user}}.",
+      "hostRunNeedExecute": "Running a host cron command needs YSK_EXECUTE=1.",
+      "hostRan": "Ran host cron command as {{user}}.",
+      "hostAdoptNeedExecute": "Adopting a host line into the panel needs YSK_EXECUTE=1 (otherwise install would duplicate it).",
+      "hostAdopted": "Host line tagged # ysk:{{id}} and registered in the panel.",
+      "hostConfirmMismatch": "Confirm must match the command.",
+      "hostAdoptOnlyInstallUser": "Take into panel only for the crontab Install writes (root / this process user). Other users would be duplicated on install.",
+      "hostAdoptEnableFirst": "Enable the host line before taking it into the panel.",
+      "hostPercentNewline": "crontab treats unescaped % as a newline. Write date formats as \\%Y (or avoid %)."
     },
     "dbBrowser": {
       "pmaInstalled": "phpMyAdmin installed at {{path}}",
@@ -13762,7 +13810,7 @@
       "disk": "Disk"
     },
     "cli": {
-      "usage": "Usage: ysk-server validators list|chains|disk|get|status|logs|create|start|stop|restart|clear|upgrade|set-version|versions|policy|mithril|prune|switch-network|snapshot|compose|settings|producer-keys|producer-detach [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--el-tag T] [--cl-tag T] [--node-tag T] [--client ID] [--tag T] [--data-path P] [--rpc-port N] [--id ID] [--upgrade POLICY] [--confirm TOKEN] [--kes-file P] [--vrf-file P] [--opcert-file P] [--accept-low-disk] [--accept-low-mem] [--accept-mainnet] [--refresh] [--execute] [--json]"
+      "usage": "Usage: ysk-server validators list|chains|disk|get|status|checklist|logs|create|start|stop|restart|clear|upgrade|set-version|versions|policy|mithril|prune|switch-network|snapshot|compose|compose-write|rewrite-compose|software|pull|leftover-remove|stats|settings|producer-keys|producer-detach|near-account [--chain C] [--network N] [--profile P] [--el EL] [--cl CL] [--el-tag T] [--cl-tag T] [--node-tag T] [--client ID] [--tag T] [--data-path P] [--rpc-port N] [--id ID] [--path PATH] [--file PATH] [--image REF] [--upgrade POLICY] [--confirm TOKEN] [--kes-file P] [--vrf-file P] [--opcert-file P] [--accept-low-disk] [--accept-low-mem] [--accept-mainnet] [--refresh] [--execute] [--json]"
     },
     "clients": {
       "el": "Execution client",
@@ -13823,7 +13871,9 @@
       "producerTooLarge": "That key file is larger than 64 KiB",
       "producerBadType": "That file is not a KES key, VRF key, or operational certificate",
       "producerEmpty": "Provide at least one of kes, vrf, or opcert",
-      "switchNeedDetachProducer": "Detach producer keys before switching network"
+      "switchNeedDetachProducer": "Detach producer keys before switching network",
+      "nearAccountInvalid": "Pool name must be a short slug (or the full {pool}{factory} account).",
+      "nearKeyMissing": "validator_key.json is missing or has no public_key. Start the node and wait for neard init."
     },
     "notes": {
       "beta": "This feature is Beta. Host changes need root and YSK_EXECUTE=1.",
@@ -13861,7 +13911,9 @@
       "producerDetached": "Hot keys removed; compose rewritten as relay",
       "dryDelete": "Delete is dry-run. Pass --execute and YSK_EXECUTE=1.",
       "deleted": "Node deleted",
-      "leftoverRemoved": "Removed leftover {{path}}"
+      "leftoverRemoved": "Removed leftover {{path}}",
+      "dryNearAccount": "Would set account_id to {{account}} (pass --execute). Secret is never changed.",
+      "nearAccountWrote": "Set account_id to {{account}}. Secret was not changed. Restart the node if it is running."
     },
     "create": "Create node",
     "wizard": {
@@ -14026,31 +14078,59 @@
       "blsPending": "BLS credentials appear after the node answers RPC.",
       "copyAll": "Copy all",
       "copyNamed": "Copy {{label}}",
+      "nearStakeKey": "Stake public key",
+      "nearStakeKeyPending": "Appears after first start (neard init). RPC not ready does not mean the key is missing.",
+      "nearAccountId": "Key file account_id",
+      "nearAccountIdPending": "Often empty until you set it to {{pool}}{{suffix}} after the pool exists. The panel writes only this field — never secret_key.",
+      "nearFactory": "Staking-pool factory",
+      "nearPublicAddr": "Public P2P (peers)",
+      "nearPublicAddrPending": "Appears after first start writes WAN:{{port}} into config.json.",
+      "nearCreateCommand": "create_staking_pool command",
+      "nearPointing": "The pool contract does not take this server’s IP. It stores this node’s stake public key. Peers use the Public P2P row above (host port {{port}}). RPC stays on localhost.",
+      "nearAccountIdHint": "After the pool exists, set account_id here (do not edit the file by hand). The panel never writes secret_key.",
+      "cosmosPubkey": "Consensus public key",
+      "cosmosPubkeyPending": "Appears after gaiad init writes priv_validator_key.json. RPC not ready does not mean the key is missing.",
+      "cosmosChainId": "chain-id",
+      "cosmosP2p": "Public P2P (external_address)",
+      "cosmosP2pPending": "Appears after first start writes tcp://WAN:{{port}} into config.toml.",
+      "ethBeacon": "Beacon API (localhost)",
+      "ethBeaconPending": "Beacon HTTP on this host. Point a validator client you run yourself at this URL — this compose has no VC.",
+      "cosmosCreateCommand": "create-validator command",
+      "cosmosCreateJson": "validator.json (gaiad v28)",
+      "copyFailed": "Copy failed",
+      "solIdentity": "Identity pubkey",
+      "solIdentityPending": "Appears after RPC answers getIdentity. This process is --no-voting until you add a vote account yourself.",
+      "adaP2pPort": "Relay P2P port",
+      "adaP2pPending": "Advertise this host’s public IPv4 (or DNS) and this port in the pool registration certificate. topology.json localRoots is for your own block producer. This panel does not probe WAN.",
       "notPosTitle": "Not proof-of-stake",
       "notPosBody": "Bitcoin here is a full or pruned node. There is no staking wallet on this page.",
       "eth": {
-        "model": "Deposit 32 ETH on the official launchpad. Signing keystore is not a withdrawal key.",
+        "model": "This compose runs execution + beacon only — not a validator client. Deposit 32 ETH on the official launchpad.",
         "min": "32 ETH + gas",
         "wallets": "MetaMask, Ledger, Trezor — only on the official launchpad",
-        "panel": "Runs the execution and consensus clients",
+        "panel": "Runs EL + beacon. RPC and beacon API on localhost. No validator client in compose.",
+        "honesty": "This instance is execution + beacon only. There is no validator client in the compose file. Copying a keystore into the beacon data directory will not start attesting. The deposit contract does not take this server’s IP.",
         "yskDoes": [
-          "Install and start the execution and consensus clients.",
-          "Show disk, peers, and upgrade status."
+          "Install and start the execution and beacon clients.",
+          "Show disk, peers, and upgrade status.",
+          "Does not run a validator client and does not load a signing keystore."
         ],
         "youDo": [
-          "Create the keystore and withdrawal address yourself.",
-          "Deposit 32 ETH on the official launchpad.",
-          "Copy the keystore into this node’s data directory."
+          "Create the keystore and withdrawal address yourself on the official launchpad or with staking-deposit-cli.",
+          "Deposit 32 ETH on the launchpad for this network.",
+          "Run a validator client yourself (not this compose) against this instance’s localhost beacon API."
         ],
         "steps": [
-          "Offline, use the official launchpad or staking-deposit-cli. Set the withdrawal address to your own ETH wallet.",
-          "On the official launchpad, deposit 32 ETH (keep extra for gas).",
-          "Copy the keystore file into this node’s data directory yourself. The panel never uploads or stores it.",
-          "Watch sync, disk, and upgrade badges on this page."
+          "Wait until execution and beacon are synced.",
+          "Open the official launchpad for this network (Hoodi or Mainnet on this page). Sepolia has no launchpad button here.",
+          "Offline, generate the keystore (staking-deposit-cli). Set the withdrawal address to your own ETH wallet.",
+          "Deposit 32 ETH on the launchpad (keep extra for gas).",
+          "Run a validator client yourself against the beacon URL on this card (example: lighthouse vc --beacon-nodes). This compose has no VC — putting a keystore in the beacon datadir does not attest."
         ],
         "never": [
           "Never give your seed phrase or withdrawal key to anyone, including this panel.",
-          "Never upload a signing keystore to a hosted cloud."
+          "Never upload a signing keystore to a hosted cloud.",
+          "Do not expect this page to attest after you copy a keystore into the beacon datadir."
         ]
       },
       "avax": {
@@ -14067,10 +14147,10 @@
           "Add the validator from Core using this node’s NodeID and BLS proof."
         ],
         "steps": [
-          "Wait until this node is synced.",
-          "Copy the NodeID, BLS public key, and BLS proof of possession shown on the instance page.",
-          "In Core web (Staking → Validate), or with Ledger via Core, register on the P-Chain.",
-          "Mainnet needs at least 2,000 AVAX, a 14-day minimum period, and a fee reserve."
+          "Wait until this node is synced and the NodeID / BLS rows appear (RPC).",
+          "Copy NodeID, BLS public key, and BLS proof of possession.",
+          "In Core web (Staking → Validate), or with Ledger via Core, register on the P-Chain. The transaction does not take a server IP.",
+          "Mainnet needs at least 2,000 AVAX, a 14-day minimum period, and a fee reserve. Fuji is 1 AVAX."
         ],
         "never": [
           "Do not send AVAX to this panel.",
@@ -14081,148 +14161,187 @@
         "model": "Operate a stake pool with offline cold / KES / VRF keys — not a browser wallet tap.",
         "min": "Pledge is your choice (see official docs)",
         "wallets": "Official stake-pool tooling (cold keys stay offline)",
-        "panel": "Runs cardano-node",
+        "panel": "Runs cardano-node as a relay first; hot keys can be attached on this page.",
+        "honesty": "This instance starts as a relay. On-chain pool registration uses cold keys you keep offline. Peers and topology use this host’s public IPv4 and the P2P port shown here — the panel does not probe WAN.",
         "yskDoes": [
-          "Run cardano-node and Mithril snapshot restore where offered."
+          "Run cardano-node and Mithril snapshot restore where offered.",
+          "Attach KES, VRF, and opcert when you provide them. Cold keys are refused."
         ],
         "youDo": [
           "Generate pool keys offline.",
-          "Register the pool using official Cardano documentation."
+          "Register the pool with the official Cardano CLI. Put this host’s public IPv4 or DNS and the relay P2P port into the pool registration certificate.",
+          "Attach KES, VRF, and opcert on this page. Do not upload cold keys."
         ],
         "steps": [
           "Read the official operate-a-stake-pool guide.",
           "Generate cold, KES, and VRF keys on an offline machine.",
-          "Register the pool on-chain from those keys.",
-          "On this instance page, attach KES, VRF, and the operational certificate. Do not upload cold keys."
+          "Register the pool on-chain. Advertise the relay in that certificate (--pool-relay-ipv4 or DNS + the P2P port on this card). Public discovery is the certificate, not topology.json.",
+          "On this instance page, attach KES, VRF, and the operational certificate. Cold keys are refused.",
+          "topology.json localRoots is for your own block producer (advertise: false). This panel does not look up the WAN address."
         ],
         "never": [
           "Do not treat this as a MetaMask one-click stake.",
-          "Do not store cold keys on the validator host."
+          "Do not store cold keys on the validator host.",
+          "Do not expect editing topology.json alone to register the relay on-chain."
         ]
       },
       "near": {
-        "model": "Stake from your NEAR account into a staking pool contract.",
-        "min": "See official validator docs",
+        "model": "Create a staking-pool contract at the official factory. The contract stores this node’s public key — not the server IP.",
+        "min": "See official validator docs (30 NEAR to create the pool, plus stake)",
         "wallets": "Official NEAR wallet / lockup",
-        "panel": "Runs neard",
+        "panel": "Runs neard; form fills create_staking_pool; after the pool exists, writes account_id only.",
         "yskDoes": [
-          "Run neard and show disk / sync."
+          "Run neard with RPC on localhost and P2P on 24567.",
+          "After init, show the stake public key, public P2P address, and factory.",
+          "Fill create_staking_pool from pool name + owner + public key. After the pool exists, write account_id only — never secret_key, never the transaction."
         ],
         "youDo": [
-          "Stake from your NEAR account to your pool using official docs."
+          "Start the node and wait for the public key on this page.",
+          "Enter pool name and owner, then copy the command.",
+          "Sign create_staking_pool from your own NEAR wallet or near-cli.",
+          "Return here and set account_id. Stake from your wallet into that pool."
         ],
         "steps": [
-          "Bring the node to sync.",
-          "Follow official NEAR validator documentation.",
-          "Stake from your own wallet or lockup into the pool."
+          "Start the node and wait for neard init so the public key appears (RPC not ready is not the same as missing keys).",
+          "Enter the pool short name and owner account. Copy the filled create_staking_pool command.",
+          "From your wallet, call the factory (testnet pool.f863973.m0 / mainnet poolv1.near) with 30 NEAR for storage. The command uses --accountId; if your near CLI expects --account_id, follow that CLI’s --help.",
+          "After the pool exists, use Set account_id on this page (confirm = instance id). Do not edit validator_key.json by hand.",
+          "Restart if the node is already running. Wait until RPC answers and the node is synced before staking large amounts. Peers use Public P2P — the contract does not take an IP."
         ],
         "never": [
-          "Do not paste a seed phrase into this panel."
+          "Do not paste a seed phrase into this panel.",
+          "Do not put this server’s IP into the contract.",
+          "Do not expect the panel to send the create_staking_pool transaction."
         ]
       },
       "cosmos": {
-        "model": "create-validator from your operator wallet. Consensus key stays on the node.",
-        "min": "See official Cosmos Hub docs",
+        "model": "create-validator from your operator wallet using this node’s consensus public key — not the server IP.",
+        "min": "See official Cosmos Hub docs (self-delegation in uatom)",
         "wallets": "Keplr or another Cosmos wallet you control",
-        "panel": "Runs gaiad",
+        "panel": "Runs gaiad v28; shows consensus pubkey; form fills validator.json + create-validator. Never writes priv_validator_key.json or broadcasts.",
+        "honesty": "This gaiad is v28 (JSON file). Hub docs still show flags — those fail here. The transaction stores this node’s consensus public key, not the server IP. Peers use Public P2P. RPC stays on localhost. This panel does not broadcast or read priv_key.",
         "yskDoes": [
-          "Run gaiad."
+          "Run gaiad with RPC on localhost and P2P on 26656. minimum-gas-prices is 0.005uatom.",
+          "After init, show the consensus public key, chain-id, and public P2P.",
+          "Fill validator.json and the gaiad v28 command from amount, moniker, and --from plus the consensus pubkey. Never write priv_validator_key.json or broadcast the transaction."
         ],
         "youDo": [
-          "Keep the operator wallet yourself.",
-          "Broadcast create-validator from that wallet."
+          "Start the node and wait for the consensus public key on this page.",
+          "Enter amount, moniker, and --from. Copy validator.json, then the gaiad command.",
+          "Sign from Keplr or gaiad keys you control. Do not mix that mnemonic with the consensus key on this host."
         ],
         "steps": [
-          "Sync gaiad.",
-          "Keep the consensus key on this host only.",
-          "From Keplr (or equivalent), submit create-validator.",
-          "Monitor the node so it does not miss too many blocks."
+          "Start the node and wait for gaiad init so the consensus public key appears (RPC not ready is not the same as missing keys).",
+          "Enter self-delegation (1atom = 1 ATOM, or uatom), moniker, and --from. Copy validator.json then the gaiad command. This node is gaiad v28: JSON file, not the Hub docs’ flag form. chain-id is cosmoshub-4 on mainnet, provider on testnet.",
+          "The copied --gas-prices is 0.005uatom to match this node. Do not paste the Hub docs’ 0.0025uatom example or the flag-based create-validator.",
+          "Save validator.json and broadcast from your operator wallet. The transaction does not take a server IP. Peers use tcp://WAN:{{port}}.",
+          "Wait until RPC answers and the node is synced before bonding large amounts."
         ],
         "never": [
           "Do not mix the operator wallet mnemonic with the consensus key.",
-          "Do not enter wallet mnemonics here."
+          "Do not enter wallet mnemonics here.",
+          "Do not put this server’s IP into create-validator.",
+          "Do not paste the Hub docs’ --amount/--pubkey flags — this gaiad is v28 (validator.json).",
+          "Do not use 0.0025uatom gas on this node — the compose minimum is 0.005uatom."
         ]
       },
       "sol": {
-        "model": "Vote account, identity, and authorized withdrawer — created with official Solana tools.",
+        "model": "This compose runs Agave with --no-voting. Vote account and withdrawer are created with official Solana tools — not this panel.",
         "min": "See official operations docs (hardware and disk are heavy)",
         "wallets": "Official Solana CLI / wallet you control",
-        "panel": "Runs Agave; mainnet needs multiple tebibytes",
+        "panel": "Runs Agave as a catch-up node (--no-voting). Can show identity pubkey after RPC answers.",
+        "honesty": "This process is --no-voting. It will not vote or earn stake until you create a vote account with official Agave CLI and change how the process is started. This panel does not remove --no-voting.",
         "yskDoes": [
-          "Run the Agave client and warn about disk."
+          "Run the Agave client and warn about disk.",
+          "Show the identity pubkey once RPC answers getIdentity.",
+          "Does not create a vote account and does not start voting."
         ],
         "youDo": [
-          "Create vote and withdrawer keys with official Solana tools."
+          "Create vote and authorized-withdrawer keys with official Solana tools on a machine you control.",
+          "Create the vote account with the official CLI, using this identity pubkey.",
+          "Only then run a voting validator — this compose stays --no-voting."
         ],
         "steps": [
           "Confirm this host has enough disk and IOPS (mainnet is typically 2 TiB+).",
-          "Follow official Solana operations documentation.",
-          "Create the vote account and authorized withdrawer yourself.",
-          "Point the running validator at those keys on disk."
+          "Wait until RPC answers, then copy the identity pubkey shown here.",
+          "Create vote and authorized-withdrawer keys with official Solana tools on a machine you control, then solana create-vote-account.",
+          "This compose keeps --no-voting. Creating a vote account does not make this process vote."
         ],
         "never": [
-          "Do not expect a browser wallet button in this panel."
+          "Do not expect a browser wallet button in this panel.",
+          "Do not paste identity or vote keypairs into this panel.",
+          "Do not expect this page to start voting after you create a vote account."
         ]
       },
       "dot": {
-        "model": "Session keys from the node; bind them in Polkadot.js from your stash.",
+        "model": "This compose is a full node (no --validator). Session keys and setKeys are official Polkadot.js steps — not this panel.",
         "min": "See the official wiki",
         "wallets": "Polkadot.js",
-        "panel": "Runs the Polkadot client",
+        "panel": "Runs polkadot as a full node. RPC on localhost. No --validator flag.",
+        "honesty": "This process is not started with --validator. The panel does not call author_rotateKeys (that would change the keystore). Becoming a validator needs the official node flag and a rotateKeys call you make against localhost RPC.",
         "yskDoes": [
-          "Run polkadot and expose RPC on localhost."
+          "Run polkadot and expose RPC on localhost.",
+          "Does not pass --validator and does not rotate session keys."
         ],
         "youDo": [
-          "Rotate session keys on the node and set them from Polkadot.js."
+          "Follow the official set-up-a-validator guide.",
+          "If you add --validator yourself, call rotateKeys on localhost RPC and bind the result in Polkadot.js from your stash."
         ],
         "steps": [
-          "Sync the node.",
-          "Generate session keys on this host.",
-          "In Polkadot.js, set those keys on your stash / controller.",
-          "Follow the official validate guide for bonding."
+          "Sync this full node.",
+          "Read the official validate guide. This compose is not a validator process.",
+          "Do not paste the stash mnemonic here. If you later run with --validator, rotate keys yourself on http://127.0.0.1 (RPC port on this instance).",
+          "In Polkadot.js, set those session keys on your stash / controller, then follow official bonding steps."
         ],
         "never": [
-          "Do not paste the stash mnemonic into this panel."
+          "Do not paste the stash mnemonic into this panel.",
+          "Do not expect this page to generate session keys or to have started --validator."
         ]
       },
       "sui": {
-        "model": "Follow official Sui validator operator docs with your operator wallet.",
+        "model": "This compose is a Sui fullnode (fullnode.yaml), not a validator node.",
         "min": "See official Sui docs",
         "wallets": "Official Sui operator wallet",
-        "panel": "Runs sui-node",
+        "panel": "Runs sui-node as a fullnode. RPC on localhost.",
+        "honesty": "This process cannot sign as a Sui validator. Validator setup uses a different config and keys. Official validator docs are linked; this panel does not switch the node to validator mode.",
         "yskDoes": [
-          "Run the shipped sui-node image."
+          "Run the shipped sui-node image as a fullnode."
         ],
         "youDo": [
-          "Complete registration using official Sui validator docs."
+          "Use this instance as a fullnode.",
+          "To become a validator, follow official Sui validator docs on a validator config — not this compose."
         ],
         "steps": [
-          "Sync sui-node.",
-          "Open the official validator operator guide.",
-          "Use your own operator wallet — not this panel — to register."
+          "Sync this fullnode.",
+          "Treat it as a fullnode: it re-executes checkpoints but does not sign consensus.",
+          "Open the official validator operator guide only if you are building a separate validator process."
         ],
         "never": [
-          "Do not send SUI to this panel."
+          "Do not send SUI to this panel.",
+          "Do not expect this fullnode process to register as a validator."
         ]
       },
       "aptos": {
-        "model": "Follow official Aptos staking / validator docs with your operator wallet.",
+        "model": "This compose is an Aptos public fullnode (role full_node), not a validator.",
         "min": "See official Aptos docs",
         "wallets": "Official Aptos operator wallet",
-        "panel": "Runs the Aptos validator image",
+        "panel": "Runs aptos-node as a public fullnode. RPC on localhost.",
+        "honesty": "Public fullnodes do not participate in consensus. A validator needs a different role, keys, and usually a validator fullnode. This panel does not switch the node to validator mode.",
         "yskDoes": [
-          "Run the shipped Aptos image."
+          "Run the shipped Aptos image as a public fullnode."
         ],
         "youDo": [
-          "Stake and operate from official Aptos documentation."
+          "Use this instance as a public fullnode.",
+          "To run a validator, follow official Aptos validator-node docs — not this compose."
         ],
         "steps": [
-          "Sync the node.",
-          "Read official Aptos staking documentation.",
-          "Use your own operator wallet to register."
+          "Sync this public fullnode.",
+          "Treat it as a PFN: it serves ledger data, it does not vote.",
+          "Open official validator docs only if you are building a separate validator + VFN pair."
         ],
         "never": [
-          "Do not enter operator keys in this panel."
+          "Do not enter operator keys in this panel.",
+          "Do not expect this fullnode process to register as a validator."
         ]
       },
       "btc": {
@@ -14243,7 +14362,33 @@
         "never": [
           "Do not look for a staking wallet on this page."
         ]
-      }
+      },
+      "nearPoolSlug": "Pool name",
+      "nearPoolSlugHint": "Short name only. The factory adds {{suffix}}.",
+      "nearOwner": "Owner account",
+      "nearOwnerHint": "NEAR account that signs create_staking_pool in your wallet. Not the node key.",
+      "nearPreview": "Command preview",
+      "nearWriteAccount": "Set account_id",
+      "nearWriteTitle": "Set validator_key.json account_id for {{id}}?",
+      "nearWriteDesc": "Writes only account_id on the existing key file. Does not send create_staking_pool. Does not touch secret_key.",
+      "nearWriteC1": "account_id becomes {{pool}}{{suffix}}",
+      "nearWriteC2": "The panel never signs the factory transaction",
+      "nearRestart": "Restart the node after writing",
+      "nearNeedKey": "Wait until the stake public key appears (neard init), then fill this form.",
+      "nearNeedSlug": "Enter a pool name to set account_id.",
+      "nearNeedOwner": "Enter the owner account to fill the command. Set account_id only needs the pool name.",
+      "cosmosPointing": "This gaiad is v28: copy validator.json, then create-validator validator.json. Hub docs still show flags — those fail here. The transaction uses this node’s consensus public key, not the server IP. Peers use Public P2P (host port {{port}}). Gas is 0.005uatom — not the Hub docs’ 0.0025uatom example.",
+      "avaxPointing": "P-Chain registration uses this NodeID and BLS proof, not the server IP. RPC stays on localhost. Register in Core (Staking → Validate).",
+      "ethVcCommand": "Validator client example (not in this compose)",
+      "ethVcHint": "Run a validator client yourself against this beacon URL. Importing a keystore into the beacon data directory does not attest.",
+      "cosmosAmount": "Self-delegation",
+      "cosmosAmountHint": "uatom, or 1atom for 1 ATOM. A bare 1 is 1 uatom — not 1 ATOM.",
+      "cosmosAmountParsed": "{{amount}} = {{atom}}",
+      "cosmosMoniker": "Moniker",
+      "cosmosFromKey": "--from key name",
+      "cosmosFromHint": "Local gaiad key name, or sign with Keplr. Not the consensus key on this host.",
+      "cosmosNeedPubkey": "Wait until the consensus public key appears (gaiad init), then fill this form.",
+      "cosmosNeedFields": "Enter amount, moniker, and --from to fill the command."
     },
     "alerts": {
       "diskTitle": "Validator disk critical",